{"type": "bundle", "id": "bundle--a45f0352-0023-4250-ae74-6ad684ca2786", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--8687c4ed-ace8-4ca9-b7e2-13f282274714", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--634fdbac-744e-4d12-810a-99d7ed407fc1", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--02689cac-120a-4645-a7ab-64fbb4d88d11", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--ae74dded-ee4a-4b96-b031-eca438185594", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d6c54b38-184b-47a1-b40f-cc7632ff4cae", "relationship_type": "located-at", "source_ref": "infrastructure--ae74dded-ee4a-4b96-b031-eca438185594", "target_ref": "location--8687c4ed-ace8-4ca9-b7e2-13f282274714", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--186a68b0-e440-4a09-aad0-8ad7538a508b", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--efd4825b-0678-455f-923d-abb05bae098f", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f438798-147d-41d4-9648-1c2281ba3473", "relationship_type": "located-at", "source_ref": "infrastructure--efd4825b-0678-455f-923d-abb05bae098f", "target_ref": "location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--14d1e293-0ca1-4b3e-be6f-67a379f11678", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ba70708a-93e4-4977-8eaa-a8361461ce38", "relationship_type": "located-at", "source_ref": "infrastructure--14d1e293-0ca1-4b3e-be6f-67a379f11678", "target_ref": "location--634fdbac-744e-4d12-810a-99d7ed407fc1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--17e83410-4ed1-4799-a0a5-0a947dd6da52", "name": "CVE-2002-0953", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--8e8a24d2-fac8-404b-8c74-41eb51539852", "name": "CVE-2019-0193", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--22d0694e-f801-4410-a6be-9d12864de351", "name": "CVE-2021-21985", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d8af4f4f-f3a1-4be6-a66f-711cad88156a", "name": "CVE-2021-22005", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--23b9dc8f-bcd5-4ce1-a916-a4dd5ce01120", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--9fba7cb8-46b4-4e8a-a2f4-3819db065146", "name": "CVE-2021-34473", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--9b8dbc2d-ec7b-4e97-ac85-08998f606893", "name": "CVE-2024-23692", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692", "external_id": "CVE-2024-23692"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "name": "Exploit Public-Facing Application", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190/", "external_id": "T1190"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25f00520-ef1c-409c-8404-aa5b2b9b4829", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.49.153.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8a5177-28dd-4478-a1ce-02116f1a570d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '100.50.65.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb94db33-bedf-446d-b2ea-42e350d4e7f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.49.190']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab38cf6-a1ae-456d-9cd7-ddc0e82e29ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.43.152.217']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67010d26-ed52-4c77-91c2-0f5f90e4c59e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.19.81']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3f980f-f179-48ea-acd0-8e7c4932d821", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.20.245']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067adf25-db8c-41fc-b55b-46ed68ed4929", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.47.26.176']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf808fb6-d415-4534-ba55-71defbe9f0a4", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.134.140.192']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00ec5cee-acb5-49ba-8893-93042306844b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.182.98.124']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b27f4e7-58c3-4b0b-a56a-0cbe54786e02", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.210.16.54']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59f5aca0-293e-4a12-ba83-7c65bf4c57a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.64.165.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03311801-30e5-4c76-9d6b-86aa0a5f2f90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.69.252.75']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3157b776-439f-485f-8770-2a8a54a17ec1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.112.54.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b52e1b4-fa34-4063-95f3-3ebf6b23f412", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '103.124.198.254']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c559b6d2-14a2-40da-9f4b-40f26b8c8265", "relationship_type": "indicates", "source_ref": "indicator--0b52e1b4-fa34-4063-95f3-3ebf6b23f412", "target_ref": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa8611f5-539a-48ce-b552-5fc435d26534", "relationship_type": "indicates", "source_ref": "indicator--0b52e1b4-fa34-4063-95f3-3ebf6b23f412", "target_ref": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ace340fd-bdd6-43ea-b264-10ff31046437", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.126.151.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b56af4ae-f042-47ff-af6e-dc0b092dc701", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.134.56.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f7536f-91f0-4e97-8feb-fb564e99cd74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.139.152.190']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29a56062-0c60-401a-982f-380b09ec5d05", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.144.3.181']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765d0454-6d0e-451f-a939-cf7438dd544f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.146.52.157']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82b5fa67-8644-4ef9-8b82-befbe404b7ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.159.199.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bf1c33c-fdda-4009-b229-a189f9a295ef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.166.103.173']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fb3a81b-e2ea-4b64-83ce-985501399779", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.171.232.30']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--765aaf70-aecb-4e44-8d8a-6a65f3495b20", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.172.236.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20bc89a6-b247-4ce8-8b13-b9f5884c87ba", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.208.219.38']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee94b853-f1ff-4a1b-9766-3ea2e9b55bcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.215.74.26']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96e6d398-452b-4e1e-b279-6a9f0eaabaab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.52.143.107']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27010ee9-0e0c-43f8-abff-620d1968e716", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.97.135.244']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8130436e-aa9f-4878-a348-9bf682474685", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.207.61.255']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d2fa439-c56f-4851-9ae3-8b9dc42b4863", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.248.197.115']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e850d505-1f73-4cab-bad0-18fcf520a4f3", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '104.251.180.112']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--88d38b3f-1e7c-48dc-960d-a678aa54549b", "relationship_type": "indicates", "source_ref": "indicator--e850d505-1f73-4cab-bad0-18fcf520a4f3", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--46f1712b-2c79-4347-8e8f-f800f29199e8", "relationship_type": "indicates", "source_ref": "indicator--e850d505-1f73-4cab-bad0-18fcf520a4f3", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f64e017a-f8da-4346-b30d-e628da189540", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.112.20.0']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54b093f3-f0aa-4818-8269-a5100259d2e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.112.238.157']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ea7b23b-cc08-46f3-ad69-5dcfdc00830d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.155.60.252']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2581a85a-da36-421d-a87a-8b1d2175800f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.156.123.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e6ff261-931d-403b-b0b9-ef7f3fd7ebef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.68.129.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--745368a4-d0a0-415d-b797-0c0595800f1d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.74.131.96']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10f8862e-d544-48bc-b278-2509c8d446f8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.220.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b8a325f-4a70-4412-ab97-e5c9fd1177fc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.222.200.115']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29308b02-e361-4968-962b-f0c5e1e0584b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.51.72.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6d4a14c-9870-4805-9df8-2680211dabc9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.122']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b122875a-e332-4154-8f63-8238b298c492", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.128']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee49b489-29c4-4d93-94ab-fef3e609c6db", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ab01dc0-2c15-4de1-a952-7d981ad76654", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e96ebdd1-7165-429d-861c-271a32ab0e32", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.48']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b45e6409-dae8-408c-b141-83f56d961755", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.77.94.222']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ceb35c-f1e6-49c2-ba90-310daa47470c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.47.243.219']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--768dc7c5-f26a-403b-85a6-ec60d576638f", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.201.163.83']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d560c83c-cd2e-4da7-b61d-61a05e9feb21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.65.212.247']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fcef847-9865-4b93-aa84-7e90fdf659ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.160.200.189']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230b49a7-ca55-4d3c-a2b4-dcc5e4d054d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.172.199.31']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d9f9bc9-b623-49bb-89f1-2256c591d4f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.174.79.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9ed53e9-1dcf-4280-a901-5c359d3806ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.179.118.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba06f7ac-4b91-4169-8fdd-01d6ecf8daaf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.44.100.222']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb930753-08b4-4658-a492-bdcedf4fc375", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.10.100.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6022046-6816-4815-a33a-f26fd5cca1a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.136']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--412601ca-e3d7-4740-aab7-1edcafd83937", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.199']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7686c978-a0a1-4d2e-bbc0-853d7c4a5455", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f46c7506-1295-4677-90ed-73b120c3651d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.133.236']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--050ef3b8-83ff-4932-9434-296aa95f34b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.136.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03163b1e-2c9d-4839-adbf-17180f343899", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a35c2dcc-3824-437d-943a-9ea71ed5d7f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.139.133']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--381f8776-10d1-4c34-ae18-241d7b51a817", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--617b4f1e-13c7-463b-b794-6282dda0ba25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.87']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7e0904-6489-40b4-9602-3be8ef7e7155", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.141.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--989f9d55-5c83-43fc-a9f8-e008aa30d6b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.145.216']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c922f159-145d-4f7e-b75d-fb0983b7ac60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.146.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f15d973-47c6-4c13-a14c-882febb41a88", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.147.137']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a02dfcb1-2bba-483a-8d14-b24543fa5a4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.149.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c290919-fa98-422b-865a-bb493bfc01e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.150.168']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3768731a-d92d-4f36-80b8-d0f6090492ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24328671-1d5e-4178-8a36-8cde4461c3b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.153']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b13c559-8f49-4bc4-a5d9-37a713e296fa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.155']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a02038b-fdaa-46d1-8102-7642bae89174", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c622888d-8c85-4523-b1d6-8edb3a24ab65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.77']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b65106c-6225-4c9c-8b7b-0c516f6dfe25", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f542b1e-bdec-4255-bb73-a64adfd303f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.50']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd720be5-bff5-486d-8f3e-bbc1aba9bf87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.154.30']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b837a2c4-b25b-42e4-9776-76e48305b634", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbe22428-fc8a-417c-b352-c58f51bbdc9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed92078-aaa3-4bb8-ba59-c8a21d336b8b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.156.188']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0d581a-20f7-46e6-a5e2-da23733d3e56", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.157.54']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4dbed2c-a3c5-45f8-9e25-d64e9f5a146c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64b11a9c-7bfd-4218-bc84-889267af9791", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.163.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1219165-c161-4266-9cd6-e30b8fb40868", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.248.10.29']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--238b11ec-ec55-41be-afa8-f5eaef1cf6b4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.49.203.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b612858e-dfe8-45ed-88d5-703c9dd0f0f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.74.7.119']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e5d4a8-c3e5-4634-b28a-d624061f3708", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.125.120.27']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6c2bf63-15a4-43e2-bbfd-6a714abf6211", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.153.81.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e073627f-a8dd-4758-a642-e19ddaa07be3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.196.253.208']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91205b3c-8a6c-4e74-aaa8-7eeec34fc9f6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.50.44.85']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76eb525f-a956-4a69-9205-bba1d7a29a24", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.72.68.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad3808e3-dab6-4b98-9190-0ae5fef5da92", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.100.168.196']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a51b5dfb-f0ed-405f-82e7-b1ca9797ccd4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.107.139.224']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8d4cbe7-e853-4865-9c85-10ae3cd2b63b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.139.164.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d37a6d-cbe7-4a85-8f19-a4636c368e2a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.242.127']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3282b9c1-5933-44bd-b07f-f75f272ea940", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.12.166.192']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0855172a-3736-477d-8296-358a051621c8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.198.206.87']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3c792ea-8d66-493a-9871-08a5e509db50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.20.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a1b554-dbd0-4efc-8d80-5e5a502035e2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.84.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b089b29-ca8a-4561-8dbe-1bfd77eee9e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.164.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7460e9db-836d-427b-9ef0-3252a83ba5cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.180.240']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7acc34c8-dc99-4af7-aef0-b88293799707", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.41.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c2c92fc-521c-4c31-a3a5-8c44cdb5005d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.91.20.139']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6151fc4e-d704-4c90-908a-9468494ae352", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.132.64']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd059798-3a79-49b4-9657-8b6bb19f7b01", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.84.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ddb143f-632b-4452-9b31-4664d522d1a5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.178.201.75']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--074bb10c-bf01-499e-b364-754c0bb4ddb1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.176.122.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f284610-06ae-4e0d-bf67-b1de996b1a6a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.8.183.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a957c2b-ea64-45a4-84b8-8327cd8e73b5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.96.31.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2d34fd2-edcb-484f-afeb-0aeec67c2385", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.1.147.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03784d3-8287-4d02-9605-d28b6802493a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.25.115.112']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e25c95fe-5faf-455d-a681-31bc178b51fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '123.25.115.189']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5cf601e-964d-444e-8bba-d526fdf2b7ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.156.231.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fde38758-4e13-4a23-976d-1cac48d424bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.243.186.243']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67e92444-ab64-47dc-adab-9319c7b96b2b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.91.33.72']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c7bc569-44af-43cc-a6fb-c55973b0acb8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.201.187.183']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90172170-000c-4f43-a2c3-b4d439919ebd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.115.165']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed1fc9ff-8e1a-424a-b62f-04214d04c1e0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.123.80']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32185a9e-49f8-4eb4-a124-60a1bf99f243", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.222.172.38']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b02e4c9-9256-415b-9ccf-cfdd2c5f4264", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.226.211.252']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79b81c81-3887-4343-af3f-b65fe067fd5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.229.154.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5405af2c-b998-4c43-ab90-aee656739635", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '134.209.120.216']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1411e2f8-8a0f-437a-be4c-f7126e39edae", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.148.29.54']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f19378-4835-4131-a909-21cecd7dd31c", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.108.24.103']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1e0586b-5222-4eee-acb8-af4fc6522975", "name": "Malicious Host", "description": "Observed: OPENCLAW, WEB activity. Sensors: cfglobal, openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.110.70.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:openclawglobal", "protocol:openclaw", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8817015e-164a-4f7a-9a1e-98241281513c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.36.189.65']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88ede854-ce80-4162-a9e6-7e4c72dccceb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.54.157.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3baedc44-721e-4e01-b00e-411b43691405", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.70.151.217']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bff9b5eb-2678-4f25-814a-cba58a7a5e8c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '137.74.114.131']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b417085-4247-47ac-a370-5d4988606ec9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.190.83']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb1e0ea0-c594-4e23-bf29-f8d3db3bff8e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.141.49']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97cde0c3-3774-4486-b235-137fc8587b63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.84.94.60']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02be87eb-4fc3-4af6-bb6c-22290489a6f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.94.226.254']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a817664-f4a5-41fb-8eec-ec8a2795f995", "name": "Malicious Host", "description": "Web exploits: apache-solr-admin. CVEs: CVE-2019-0193. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.133.249']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--254d5f94-7a4b-4e7a-8ef6-602f429832a4", "relationship_type": "indicates", "source_ref": "indicator--3a817664-f4a5-41fb-8eec-ec8a2795f995", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bbab6072-07ce-49e3-bafd-c2535bf2352c", "relationship_type": "indicates", "source_ref": "indicator--3a817664-f4a5-41fb-8eec-ec8a2795f995", "target_ref": "vulnerability--8e8a24d2-fac8-404b-8c74-41eb51539852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36145130-500d-494f-8fdd-50978e422d4b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.59.16.152']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57526de-177b-4e76-baeb-3e4b07467523", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.107.234']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb1f80f4-2b5f-4372-862e-71533b597ba5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.107']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7ddcdd-2444-4420-803a-5a2553446f48", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b46c3fa-0c77-44a2-97df-3a6a0be1ed44", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.118.197']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b877a84-a9f6-47fa-ac04-50be0915d867", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.167.167.137']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f40831bc-6f33-4df9-94b4-f566b3a9fa86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.171.132.83']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd1b75f4-b9e1-44f4-a4b7-8fd209ea0ab6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.191.250.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f44e7c6-6e58-4792-b617-7c5e5ea48531", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.44.31.59']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db5d369-55df-4d5b-8c7c-0f205e29fda5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.206.236.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb807d52-3469-4df7-a2b3-7314b530906c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '140.206.236.95']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81b680ee-183e-419a-9411-c2ad5445a7e5", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '141.94.245.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23bc2e0f-fe3a-4d4b-bb94-27fc9739412e", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '141.94.247.140']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a9727f3-44e1-468a-907d-8158a93364aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.111.152.47']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a8ffea4-8712-4140-a050-9be56b5ed873", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.20.60.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec56840e-5c89-4673-a7f5-eaa0d98a6d49", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.57.121']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d97f02b1-ff24-4039-bda9-0579d6c37a71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.57.123']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--432da589-effc-4982-b476-cb0f898330b2", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '143.244.57.84']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fca1531e-afc9-4c4f-9a91-410a4f0234cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.246.197.73']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--104541e1-e367-4159-b9de-fc810f7ab2e6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.172.64.68']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4a130da-7e3d-4421-a60b-dc84f8098bc2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.225.87.189']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecd4fb01-732d-4b0b-b7c9-be630209c5ab", "name": "Malicious Host", "description": "Observed: WEB activity. Web exploits: wordpress-wlwmanifest-scan. Sensors: cfglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.194.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:revproxy", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f06cc2-0887-4f0a-b1c9-6ee99d5da232", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.182.219.22']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3acb8be2-d255-4c0e-a95a-5ffd3e68af27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb355bfa-e6a7-4bb7-849e-2441b07d12f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a939874-c1f2-4bfd-b249-7f6df07a9640", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.117']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c3708ef-e336-4b0a-98c6-c18a0ea5e5ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.118']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b3007d2-1ad4-4309-b1d0-aefb94da1865", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.123']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca9e7a38-89a6-455a-9824-321fd2272354", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.147']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1e4c3be-674b-45e6-a9f3-39df8982e822", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.15']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cde4680-15c8-45b5-a83d-c0e6adf75300", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.150']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a14e5c1-e5a2-404c-a767-04dc686f2253", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48b22279-6c0b-4491-af97-d6d0a2d8fb5f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.192']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98548f14-5f42-4b1b-a9e8-994888088ddc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.195']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a006d4a7-df7d-4990-9186-09b6202e5c8f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.216']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb12a571-1373-4cd1-bd59-7697a3b120b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.219']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7131d3-a682-4fdc-b51f-18909e7cb507", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.234']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a16b29af-9330-4ec8-91c0-73fa541501a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b50d3c9-96c3-4780-b4fd-abe93dddca03", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc5bf8f5-cf28-4175-8079-cabc4807a8e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.28']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e889c0f-e1b0-4529-adab-33eae400c02e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.31']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7677c8f5-75d0-4d62-a72e-ad450941c025", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--381a4e02-c4be-43e6-b84a-e574f1cdf0ac", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79c3a138-5e42-4b01-8180-c5db3a8f8216", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.42']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1029e322-6d5e-4068-b1db-f1cc01975e93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf675748-d62e-408c-a887-3644a75c25b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88a61d69-feb3-4342-82e7-3d86c698d778", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.55']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cd6ec67-c1e8-4f40-8f22-8dd13f47c79f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.57']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4206dee9-8ce5-48c1-a706-c2ae0996c07f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a561752d-f6b9-48fb-8021-48ffb8f4a016", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d421677f-c0b4-4cf2-9eb8-9cb48f081b38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.76']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1d35bb1-f42c-4631-9695-456e4617c2b3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.9']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3515843-ff6b-4061-818a-0c2274e98596", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.90']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--667e0250-8f94-4d45-bf2d-b9054d2ee65a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.99']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6821926-e671-49b4-bc5f-9905dfdd4493", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.200.13.30']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfc2ffe2-0108-4d0b-8daa-4503fac3046a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.232.131.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ec2445-fbff-4c3d-85fb-226d64e80afb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.232.131.62']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cec56a26-ff8f-4721-8885-a921e7b60467", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '149.71.0.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--680e9a1c-86b3-4f1e-8396-abb40daeb587", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.159.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c993762-0c1a-471a-b1ce-7960e2320bc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.46.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec90818f-65c6-4b32-9ef7-aed6009a7e2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.243']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4c09622-0993-43ef-bf10-a6e43736adef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c74dfc-9855-4b34-8f1c-d19eda3d3f7d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.132.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e41fdc-a82c-4ad8-a1ff-475aab0660f3", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.243.11.230']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ad0bb50-a542-4fef-8af8-e8e63c7e9a84", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.200.205.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10c208ee-7645-47e6-852f-6f7bca46de33", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.70.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1637c074-7869-4db3-b3bf-4a406ef9ed1d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.18.197.35']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b7ac8f4-949c-4b60-ab59-acae11c72ce9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.192.160.111']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70aec19d-143b-4a63-a84d-b0448db64b19", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.57.214.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45fa98b2-d998-4074-b021-4e29884a9fde", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.83.16.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9f84753-29b6-41bd-be6c-6d6ebab78507", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.155.18.146']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c8775d1-436b-4ba1-b747-740f8fcca1d7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.225.14.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87fe0552-d5ae-44eb-9c11-61fcaa0404bd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.228.188.117']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10acc819-c6a0-4d57-8473-18bbb9ca980d", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.14.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca462439-4358-43a2-acab-2834c3c0a32e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.230.218.106']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79779657-e893-4c29-adc7-2b28f6e144a8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.245.240.41']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1748a7a1-a0da-4467-9ffc-c09986e1e5ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.138.122.103']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9ac1c13-4678-4a0a-aa49-69ec4a44f359", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.138.85.214']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce23e932-d72a-4c40-8d46-b48c5e78f293", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.138.89.187']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '159.223.16.243']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5baa4322-4109-4d26-8f20-a305317cb3ee", "relationship_type": "indicates", "source_ref": "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6a04681d-db87-43a8-be5d-e166c1358305", "relationship_type": "indicates", "source_ref": "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "target_ref": "vulnerability--22d0694e-f801-4410-a6be-9d12864de351", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f622e3e6-12c7-45ee-a115-fc9cfe7abced", "relationship_type": "indicates", "source_ref": "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "target_ref": "vulnerability--d8af4f4f-f3a1-4be6-a66f-711cad88156a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd2411ae-9feb-4fb0-9397-2c55f8c15afa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.65.9.175']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb32be5e-c428-4737-b5ec-055191ea314b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.89.87.217']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9a76d64-0396-451f-bd75-2f710b8d9f56", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.5.0.234']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9443690-a6a4-49cd-ba98-f7531ccbb60f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.250.132.238']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--101ebc72-31d3-4526-9c66-2db03cbc2b3f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '160.251.101.169']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b09b80a9-e0d8-46b0-9e15-e342e86ec751", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '161.118.193.172']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f161ccb8-68d9-42d4-85c5-0ea2fc6f919a", "relationship_type": "indicates", "source_ref": "indicator--b09b80a9-e0d8-46b0-9e15-e342e86ec751", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2b2c0163-8618-4c0e-8488-9b22c69659e3", "relationship_type": "indicates", "source_ref": "indicator--b09b80a9-e0d8-46b0-9e15-e342e86ec751", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3d6c783-45ea-4ab5-84e1-c28bc6785789", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '161.118.240.138']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d31da6b9-ab69-4122-b3ac-3bd2e7e617ee", "relationship_type": "indicates", "source_ref": "indicator--d3d6c783-45ea-4ab5-84e1-c28bc6785789", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0a00ca32-5ef6-4ec7-96a3-a78e47bd4cc6", "relationship_type": "indicates", "source_ref": "indicator--d3d6c783-45ea-4ab5-84e1-c28bc6785789", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73695f1e-60f4-4c53-9fb8-6d5551cf101d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.18.92.246']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--666d103e-927b-4c6b-88c3-06a161e3238f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '161.35.48.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--88221bb2-e58c-485e-8055-506eec8af874", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.217.103.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8876b46d-1f9c-44ba-8f37-ea2317fadcf9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.241.29.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7aed01c7-75bf-4b9b-b9db-785d71c1e926", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.213.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dfbb1ca-b8d5-4aa7-94c3-4fa1511e8340", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.12.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2589c8a-f8f4-4572-8a0d-4875e9507ca7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.52.105.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '164.92.243.60']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b3fe3b64-2736-4622-b10a-c5a90448e6f1", "relationship_type": "indicates", "source_ref": "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa45beec-cf8f-41de-91da-a59f1bc2c0b0", "relationship_type": "indicates", "source_ref": "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "target_ref": "vulnerability--22d0694e-f801-4410-a6be-9d12864de351", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--050cc838-63db-4d60-91d4-838e0bbad2bd", "relationship_type": "indicates", "source_ref": "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "target_ref": "vulnerability--d8af4f4f-f3a1-4be6-a66f-711cad88156a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--230ee2db-60e7-448c-95a4-221d7744d341", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.12.137']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dea6b652-982a-477e-861a-994067ddee66", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.2.143']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30674f96-16c5-4048-9625-ae229cd8b868", "name": "Malicious Host", "description": "Web exploits: apache-solr-admin. CVEs: CVE-2019-0193. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '165.245.223.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--41134026-0ee5-460f-a3b7-6421b87c1afa", "relationship_type": "indicates", "source_ref": "indicator--30674f96-16c5-4048-9625-ae229cd8b868", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--398c402d-2371-435b-a9c2-b9b8d2cdb90b", "relationship_type": "indicates", "source_ref": "indicator--30674f96-16c5-4048-9625-ae229cd8b868", "target_ref": "vulnerability--8e8a24d2-fac8-404b-8c74-41eb51539852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af89719f-8880-4178-aa85-10ad42ba64e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.108.4.48']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4389969-cd12-449b-bd7f-813f11972c6f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.202.30']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e123692-a7a1-4cee-9b50-936b132b4fc6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.56.174.57']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1a475f9-78e1-4736-b7bb-3190af9332cc", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '168.107.89.182']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce0a09f5-5851-436a-a190-f0628d22465f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.11.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0020f72-d154-4753-b63e-96e8f82c879d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.110.146']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15d1343b-cb96-4e7a-9b32-1da46721bfae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.113.235']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b50757ed-4296-4627-aad4-d2208fb43366", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.116.229']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e81cca8-0b42-46cc-b7ad-62dada502aaa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.164.79']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bd74719-21b6-4c15-8219-aa46733c949e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.169.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ec0a69a-b01a-4be4-93ed-2bccf6f36f60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.198.63']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67f485e8-68ef-4400-ba96-4b3e3f7b286a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.99.233']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7d57430-1ff2-4552-9a4b-aaee20a38a50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.239.61.226']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7932e44f-97c9-4a0d-9c3a-98b5a3d7ffde", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9555c45-0dcc-4eef-9842-d7d9c75551cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.120.190.40']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c825cf-9148-4706-adac-9f1e24f01307", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.173.200.62']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b0205d-52bd-4c11-8c5b-7f73c69af994", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.249.52.138']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5127616d-5815-4c7a-86d0-25c4fefc2a34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.141.31.133']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--34988394-700f-4d1e-8927-8aa1291ce967", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.163.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a87553b-2f7a-4957-90e4-b61861e6ca13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.248.109.22']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a640851-6255-4390-b142-78e12fc0a495", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.30.156.243']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--143661e4-eda6-470a-a57b-545f19e084ce", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.138.23.32']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e093f31e-80f4-43fd-a1ca-a594c1e255a8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.182.222.127']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7a1f460-d5db-45aa-bba1-c99eb599002b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.226.182.242']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fd646f6-387e-42ff-b4f5-6c0e27c75882", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.38.110.160']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ba46a5c-a346-4b48-8ab1-e78311039ede", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.39.123.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58e585e7-b422-4565-acfb-5e2c6ca0be2f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.75.104.210']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e62909-463c-40aa-bf0a-cc175d4c2f3a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.84.217.25']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f87157e1-224b-475d-8379-a577c8f4e7e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.121.24.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddb2154-aae5-4fe9-89d6-4ffadb4d8d20", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.185.129.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d46ac6cd-10ea-4392-af58-5c3978c71164", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.106.84.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6b91ea4-2a5d-4fea-96a8-2b75eaab4bec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.186.165.147']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58b2b3f8-960f-44fb-b617-ca56e03e8009", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.208.48.132']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--445d7ce5-7734-4574-963a-7488ad85ce15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.238.89.110']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f7d836f-51db-465f-b5c9-ea52c322882b", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.167.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2afff615-3af0-491f-b75b-e85603caa4e9", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.49.192.188']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37ce18d5-696c-4460-b007-56898de00346", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.60.64.154']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9f9f652-c151-4daa-b332-dcfcee62d8ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.153.197.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd44c5a2-13de-4a53-9f60-f5ab63793d7c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.153.197.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d454510-8f5a-42ca-b44e-c3dc1e78958d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.117.184.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d8b3304-2b02-41f6-8f11-98eb661a22de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.21.132.197']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea5c98ad-a4bc-46cf-8dbb-de7b6f7340e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.54.1.51']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbbc4432-4e79-41f1-a34c-35fc5d4129ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.94.250.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18ccf08d-8caa-41df-8d0a-95844ac8c224", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.149.104.197']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--127f2731-1135-4f7a-a7b4-77a400687ec1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.160.3.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65450d68-eb1a-4822-a9be-9af6f041bd4c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.182.220.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9154c934-3db8-48fc-a5b7-58d340d98dda", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.237.13.208']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5e27469-fa5b-4e70-bb11-c9f577997322", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.93.50.90']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e23a47c-5d4b-4c27-9045-a11618629ad3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.247.202.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ceac63a-e26c-4aec-b0b1-ee48389c5f28", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.56.197.63']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e3e7483-b0e1-4e81-b53f-a641fc970d9c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.91.11.36']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5074d72c-ca8d-456a-9e3d-b3e3ab3044bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.117.225.181']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04979367-5017-44ae-b414-26b78757a21b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb7ddf7c-727e-47ff-a3b5-7c6d336741d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b1a1a55-d085-46e3-a2eb-43a15b4413a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc498dd-7032-4c66-bca7-5050a39eac98", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--788444cc-ee72-4f58-909b-8f6460c01e51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f800c3b2-0df6-4eda-8186-38e8295d62e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04874ddb-a7ac-41de-9881-80098d33444a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3952bebf-4aea-483b-bcd7-d853b8058b07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--704ce900-9103-4bd3-8821-59160a920bb7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2b62740-2902-45a5-ab43-034a182e20b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5efbb34e-baf8-42f8-97c5-a493975fffd7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cbd0cb1-ea56-43a4-9bea-51bf408af2f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3ae58a7-faf7-4b19-98a5-1f5f1a4b5988", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--247ec672-a5b5-4620-a25f-9ad3ef65e55c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f82320-8b0e-4e5c-9731-b10d47db6112", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--563efd26-1aa9-48ec-acf4-b25d655829f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ade6c2ab-3883-4cd5-9b46-2279aaefe06e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d848a8-52e9-4370-992b-737dda8c5842", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ee04736-fa85-44ee-97b5-80ace4e64c07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf76e02d-8778-46ca-90ba-2b8f0f0dd27f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d446b0e9-12bc-440f-ae7d-a8d15e71e92f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.220.100.244']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ad1d9db-a009-4eb8-ab23-988a54819e02", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.197.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca1d0451-827c-46ed-9562-77089289c7ef", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.240.215.110']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7f321bf-e6a8-4c7c-9c33-c9b7a183ea5d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.91.209.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d34a389-f52f-41ee-992e-eeac662f39a1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.10.142.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37292eb-e868-46ec-bc7f-f87b9b2ed86c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.22.54.161']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e962ff-88ac-4b86-980d-a9bfd000e0bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.104']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36450077-b21c-4d4f-890a-edc36b5e130b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.83.204.212']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c734028f-ecb7-4471-9ecc-64cd91dea494", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.139.134.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edb7e667-6102-4583-a2fa-ce9e1c596bcc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.145.46.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d211edf7-f233-45d4-8c72-47d98c6d8174", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.174.238.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c866816-54b2-4351-9e69-f49d8c15cb82", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.212.33.78']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf48d634-29c7-4d8c-9fb3-98eff2247604", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.216.224.85']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7adca3cd-3216-4553-bfa6-c451423b43bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.255.97.185']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99afdbb9-7d85-4cdd-8496-e7053bad327a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.100.69.104']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef7fccc3-cb4a-45fd-a747-b9d8aa74fee5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.113.68.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab90fff5-e9c0-4d2e-936a-196ec88bd121", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.188.37.150']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48467851-212f-4401-84d6-5a0f0f1f80de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.19.107.174']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df6b280d-bc3d-4d95-91c8-9f12daa17a0d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.204.230.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ddfe239-4f73-4621-92a5-c709c8a74f6c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.243.178.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39480def-bad2-4893-958a-9a7241944ab6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.62.47.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb497c92-675c-486f-9f09-2bef265d4b5d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.105.123.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07295789-2906-4f59-b2d2-6d985ecda721", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.110.255.239']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86e983d2-cb3f-4f97-828e-163c08d35c5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.110.46.199']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab5ea712-cacf-47c6-9d44-cfc891e79955", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.134.21.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f939eb08-2177-4018-8014-eb5b6f78b076", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.149.6.54']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70113332-a496-41ca-853f-5a362f850267", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.25.119.113']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1248a5b-0a54-43c0-b46b-55e3a862e9c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.44.152.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f52d070b-e25b-49c3-918c-162eb4f05c52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.5.49.1']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78d03121-388d-49f0-b29a-df2bf2e2d42d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.6.47.148']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa038353-07d5-4111-a456-6f18c894f461", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.33.144.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6b7121e-994f-4d1d-befc-6ff7747dfbf5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.36.228.98']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--124db511-0f6b-47a1-b26f-f81aba3accc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.5.174.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b3fcdd9-4ddf-43f9-95cf-a808f3e1dd4f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.98.18.230']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d566f202-c1ce-492b-a4f4-41a7bf4a4aa6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f055319e-8cc8-4d33-a6e0-1ac706d736a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b508d724-a69a-4ff9-9c1c-d64d53f1a046", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.163.125.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f29fde1a-bfe1-4af3-b098-047d8babb1ea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.218']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73e11f05-a193-418c-aa17-446b305c8b41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.249.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b70a0ebf-4ec1-4bb9-bd51-9dceac6678f5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--794c5ad9-8289-45f0-a9db-6c6b64608b86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.47.62.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--511f53d6-f761-49b4-97db-9cda24533c3f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.56.28.207']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--05523f57-164a-477f-be8a-d5ffbe07ff62", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3babc0f6-e9d9-4352-a79b-f2d6c26e6964", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.12']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69b93ae9-8149-47a7-945c-1249d3d1cf3e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a1d4bad-fcf4-4e48-8277-78645a0a3db4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.15']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbf53d0c-d41e-460d-b9ae-68de3ae41848", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a73c024d-1ec4-46db-bad4-53dd3a749878", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39343ce0-7635-43ef-b96e-f0718803be8b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.5']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c289307e-2f95-4f4a-b04d-549e6105abc8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5afaddf-4c77-4d41-aa22-e22bf9cc7f95", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2182999d-4983-41a2-a2d9-9f7a7806713c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.211']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e22ff77-65f4-4d78-a2e1-96c14bca3677", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.227']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71d878ae-b023-41f7-90af-ddb5cdc2c2f1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12f50b27-c19b-4a41-a218-0b732f385e1d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.232']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6512fcdc-9fa4-4cdf-af90-0aff1687ac2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.115.61.161']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c41f0941-294d-4367-ac4c-9e5b1b67f28f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.189.236.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--758d3a24-9372-44d8-be0e-15adde34d27b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.135.111.101']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd92120c-7c93-4aab-a638-e82905ae6b0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '197.15.65.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0752448a-6bba-4a80-9fd5-6334c0c5d536", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.144.189.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f290387-1886-42f9-a9c4-7fdb74f90b6a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.199.79.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13cc5a17-df71-409c-9095-dd8c3ffe70ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c3daef11-7064-42bc-8486-2fd3428e1b01", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.101']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--548ac1ea-115c-4373-9c0c-c142197b6815", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.102']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce123f13-4c2f-499a-a8f0-aecdff1c06ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.103']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02b3790b-06a4-4f35-a0d5-00637aa776d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.109']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443ed0d6-a981-49d3-b47c-e93bdc68246b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c4740c6-c932-4d9f-bf82-b1a7f9543eff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d49a25f0-5999-4f4e-8ade-7ff0e3c311be", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.121']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c496f97c-3773-4b20-ac2c-69a20b443c90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.124']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7c66d72-6726-42c9-9993-6c118432bd6e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--864ada06-230d-4bba-abf3-3039598937fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.130']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab584665-77d3-48b0-8a5d-8fb3d8921b12", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.133']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d42a516e-2b68-454c-891d-88a59a630d80", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ca0f212-4cb1-47f5-99e1-4a75e26eb5ff", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.137']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3adfc66b-2f99-49d3-93c0-ea6f328bf5a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0241c0fd-e515-4237-a834-bbc27f7179f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.141']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e0dfa3e-aa50-4338-acd6-573c490d1754", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f275f2e2-c6f5-4e0d-9448-efc35c7c883e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.152']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--305e9726-ec3e-455a-b07b-e6b8f1cd667e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.156']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76abe7e1-c0ec-4cdd-af8e-ddfede7746f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b640cf-11f5-4a3f-be84-f18c632e6473", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.161']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1f1f761-0726-4d9b-8dfa-e826bbe6051e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.168']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6adbe88f-12eb-4f9d-b09b-f4efaf9791ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dddc66d7-7f1d-4587-9f7e-8a66561eb543", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac7e243-2b8a-4f81-97cf-d8c715c1ab7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c35277e5-e904-4576-85b8-0769c51dd325", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48fa3048-7348-4850-8aea-ccdf6f7b5ed2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11533dca-a08b-495d-b7d4-18902f762b0b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348ae482-65ad-4298-9b14-a56c1528ebc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b524bbb-a3a0-44cb-ac4e-1ab2735884db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa22829-cb3f-404b-8369-ebda431934a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.209']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b674007e-ccb9-4618-97b6-95e55cbfcb21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.217']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--795c5b63-be8d-42b8-8814-29b98fc3475a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.23']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3e2e7d4-d784-4aa7-b4de-bd2df46006cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.230']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23a62089-a4ce-4662-8991-b7a49e31dbfd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.231']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff1e15a9-5050-415b-913a-23818bd8ba26", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.236']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1a3dbbd-5abc-41a7-9ab8-301b55e796c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.238']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffede2a4-6ea8-416c-968f-43aece24d44a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.239']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c00a01b-ec01-449e-b76a-dcd78b23f6a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82c0dadb-756f-4aaa-8bd7-fc7158a06f9e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--692e62ad-86ef-4c17-9723-7dd7f030f785", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.247']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7362135-7cee-4cf0-a77e-9b694feb0314", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.25']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeca41ae-27f5-4e45-a89d-aa0307b657f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.31']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b4524ba-6e9a-41f7-9304-35c3555051e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.35']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d68804a-99bc-49f9-ae1b-a951f7722eaf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514698d5-2aac-4dcc-9eda-dd9042eca15d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.45']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5c9cd55-1caa-4d6a-9116-a5b671388cf1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45e03775-1bdc-4f8b-a1b4-3fc665e5617a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.53']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c79cd3bf-2c36-4efb-a260-42cfc7118b75", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.59']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369c849e-a9f0-451e-8074-0214cb97936d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a97f16-4e1e-4f59-abe2-57538910eaff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f51b342-8760-4210-8898-e221712ef2fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.76']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e624d62b-8458-4e80-add2-692ada7bd5d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.79']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83c81c72-252c-4450-a4e3-d9b7004e7713", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.80']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f4aae41-6727-429f-b7ad-1b3e9f7ed6e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.89']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e28e0197-610f-42b2-8282-a1ecb0af6f8e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b22553de-88e5-4df8-9e9a-5a1dbf6415e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.95']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6f4e465-5410-44d2-9aa6-5ab430967493", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.200.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7be96c85-511c-47bd-bb08-2b0b71ccad94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.102.44.194']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7fe363f-e4fe-4c53-b050-c99b4dcb5bf6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.195.252.209']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b32a28d-d9ba-4621-86c8-2d7ce3317b75", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.120.38.245']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4f3ee37-8b3a-4417-8de6-fd1aa8d2a8e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.32.254.102']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02405325-69e7-4b4f-b4e2-a02293c1a0ad", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd3b4c60-420a-4fca-befe-785dbe13b74f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--135a62aa-6569-404f-995e-e464d7bade86", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.168']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f247b3bd-2064-4a7a-94fd-727bcde3c94e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.53']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c675d3d-9e03-4a8b-95f7-d8119a1fbdd5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '20.106.18.245']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--11e432e2-7062-454b-bfa4-0cdaf5e59b34", "relationship_type": "indicates", "source_ref": "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--883f283d-4c9b-41f4-96ff-351a2e61f9b5", "relationship_type": "indicates", "source_ref": "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "target_ref": "vulnerability--23b9dc8f-bcd5-4ce1-a916-a4dd5ce01120", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--28ac1da6-5c8c-4182-81b8-001080b0c002", "relationship_type": "indicates", "source_ref": "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "target_ref": "vulnerability--9fba7cb8-46b4-4e8a-a2f4-3819db065146", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7dcc9fb-dc61-4dc9-a93e-48d45106411e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.171.192.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dccd831-d642-49c4-b46d-ee561d471762", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.200.211.114']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--631cb4c0-d2ad-4cbe-84dc-01e698edf57d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.219.160.77']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f3f0291-2baa-4ca8-9161-ef81347cb4ee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.126.105.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3810a84-bbfe-462b-93f1-9813cc2cdf52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.163.188.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e26d7fef-f45d-4e43-9911-3e81b6612f5b", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.166.5.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29ad58f6-5adb-4bab-a368-60d68a26769e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.172.175.235']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06533366-08f9-49e8-83aa-b94fcc997be5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.176.20.170']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38d75ffb-af4a-4e3a-a796-20e231e2f003", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.183.56.49']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--29b059a6-1a35-4e8b-bc9b-7a20e9221226", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.189.63.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13b9ee4b-aef1-4ecb-b978-e46281dade59", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.48.253.42']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5ddc2e7-8f55-400d-a3b1-374547638c5a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.77.124.248']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "name": "Malicious Host", "description": "Web exploits: vmware-vcenter-sdk. CVEs: CVE-2021-22005. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '201.79.8.244']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "external_id": "CVE-2021-21985"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "external_id": "CVE-2021-22005"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cb4e959-c485-4763-a381-30277cdfe728", "relationship_type": "indicates", "source_ref": "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53ab7815-4ae9-4fdb-9cac-4d6df10db559", "relationship_type": "indicates", "source_ref": "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "target_ref": "vulnerability--22d0694e-f801-4410-a6be-9d12864de351", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--40f18943-0fdc-411b-9280-5be3816ca857", "relationship_type": "indicates", "source_ref": "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "target_ref": "vulnerability--d8af4f4f-f3a1-4be6-a66f-711cad88156a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa33d9ab-053a-4dc4-b839-9d98cec4cf9b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.47.51.124']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a271df-dfb2-43d8-92fb-2839c84e1612", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.47.51.150']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24bd1ad4-b100-4cf4-9c32-aaa4c47457ed", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.121.40.210']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e15b60d-8957-415c-88d7-f0f2c6f42665", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.128.6.159']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547ce0be-1c2e-4e43-b1c6-512e37e50d8f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.195.164.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0f5a5a-54db-42fb-ad07-30e9cf63c736", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9582e77-c29b-49c7-928c-af4d057f3a94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.12']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39526912-80d3-48b4-a8d3-d2782bf64cf4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9876404-23c0-4448-a02f-f03b8c0c87f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.139']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12ac7388-a367-4690-b957-e64fc4de7147", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.140']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bd1962d-823a-4013-8a74-4c55666fdedb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.144']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baae4fe5-40b7-41cb-8541-3ab33c6dad3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.148']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b10c2a9e-133d-435b-9623-548bb5f50f65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d51835c7-2401-4b5b-822b-b18c68a23f65", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.155']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4d4eb1-e1d3-439b-badc-ae8a48af429f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c81a382-164a-4d00-b1e6-00940f171e3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--228ba11a-b1ba-418c-9f15-dba6516589ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.183']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49ccdee5-6f27-4dae-a74a-59cfc7cd1e18", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.186']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b03de004-47e7-407c-8e2e-43e18dff44e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.198']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bacfd92-b2e8-49ef-abf6-23cdeba3cddf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bd55cb5-ac43-4aa5-9227-edc8c791404f", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--196ed3b3-74fb-43ae-9727-e8a8c012da1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7018382-ef05-4bcf-bb1f-2f53ce179670", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24c9f6bc-6786-4ed2-86dd-e339c6eafee4", "name": "Malicious Host", "description": "Observed: OPENCLAW, WEB activity. Sensors: cfglobal, openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "sensor:openclawglobal", "protocol:openclaw", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22f23f13-a99f-4c5b-bff8-336faea451f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.206']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c33a12d7-bf64-47c8-886f-3e1d24eb1c21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.207']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e721a8a-b993-4c93-9381-0fff773dc5bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.216']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46912145-c78c-49eb-bfcc-9a812593f4ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.22']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ccd07e4d-a553-41d9-b083-968cd91cd24a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e6cba27-6c43-412b-aded-9f46aed39580", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.225']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0462df37-b51b-48b2-b601-b6f547af8311", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75228610-2aed-4adf-9e91-63813ecb5c0d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1dc4b4d-303d-4210-acb8-b857054d1c3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.235']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eebfacc3-d1c5-478b-8841-eaec0520faf5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.238']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--64d97d70-93a7-4075-99cb-c8b0e035ee16", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.240']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb06dc9a-0f16-4787-88d6-3e2993d0846c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.242']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c020b98-84ca-401d-a9eb-223da8d0d530", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.249']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b52f9c2-62a5-4089-8fc1-22108753e659", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.252']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc3e75a1-cb67-40dd-bdde-1bde77940571", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.255']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--996890da-4f74-4d1f-9d06-2cd418d19ad0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.31']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5896fce6-51e9-4f03-a52c-46faf7b1936d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.32']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09a2d9ed-9153-46bc-9e60-40989f24ee31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.34']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4669ba6e-4700-48dc-8fa0-566673df6e7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.35']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe7385f-aa11-4b7f-b6f9-c7ad7263a9cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.53']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46fc8ea0-8105-48a8-a4ba-381632356578", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.54']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68cf0e5a-ad5d-44e0-a03d-fa76d54b9b41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.59']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd9e2c8e-ab4b-4870-ac8c-873e2b2c502e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.64']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecee3221-f25f-453e-9613-8a7223fa4955", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3301e2c8-4118-4e18-b411-c9b12ffcf5c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ce3c6ce-77d1-4b12-8910-0f795c0e63a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.75']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--101d25be-ca52-4fd5-a69f-10625cf71535", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bea75a0-030d-4a24-b093-3143a682acd8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbc2cfbe-a145-49c6-9182-1dc322e3bbda", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.88']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50fab29-9a45-46f2-900c-7c28154e5fc1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef98938c-5d1d-4815-9c65-e79f9c9d40a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.93']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbbdbb88-b401-4170-8346-f51a905ae7ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb25fff-8c96-48cb-83eb-9e66170c68ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.96']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2002-1149, CVE-2019-5418, CVE-2024-23692. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '206.72.199.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692", "external_id": "CVE-2024-23692"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--85a960b7-a27c-48a0-9fec-ece50bfd87e2", "relationship_type": "indicates", "source_ref": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d0c43c0-d994-4203-b475-417574d72ad8", "relationship_type": "indicates", "source_ref": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7082e7bf-08da-4157-966e-0f85bb840925", "relationship_type": "indicates", "source_ref": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7007215f-7e6d-4c30-802d-7e4567b0eca5", "relationship_type": "indicates", "source_ref": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "target_ref": "vulnerability--9b8dbc2d-ec7b-4e97-ac85-08998f606893", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31c8b8f0-df2b-4095-a7d6-068387d52870", "name": "Malicious Host", "description": "Web exploits: apache-solr-admin. CVEs: CVE-2019-0193. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '207.154.240.198']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dc384743-39ed-477a-b300-6effa8ea426f", "relationship_type": "indicates", "source_ref": "indicator--31c8b8f0-df2b-4095-a7d6-068387d52870", "target_ref": "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f4f258ef-912e-4c14-9889-689af855d431", "relationship_type": "indicates", "source_ref": "indicator--31c8b8f0-df2b-4095-a7d6-068387d52870", "target_ref": "vulnerability--8e8a24d2-fac8-404b-8c74-41eb51539852", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9d4ccc9-2637-4cfb-9263-2efdc37f9e04", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.206.224']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15e3b607-c236-4edb-8185-d5f813c522f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.46.13.155']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e62b5b-a3e1-4148-bc5d-7cee4b0e3fa8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.46.13.229']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--065b18c1-a0df-48f0-9697-fc5f6f37dd60", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.46.13.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33e98975-c216-4de5-b50d-5f6021d292a5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.50.163.214']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6297939-4ca2-4b28-aff1-e9afcb0281f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.78.73.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db4e43c9-5067-4771-b8f1-d552bf71c145", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.97.163.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94cf1e19-ce29-46cf-b154-5ab3cc882793", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.99.184.98']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--319cd005-c095-4d9e-8202-86f3855d0fe8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.227.14.78']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e29502c-b516-412b-957e-3507473c4ee8", "name": "Malicious Host", "description": "Web exploits: mitre-t1190. CVEs: CVE-2002-0953. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.152.186.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3baccdb8-c805-4354-91a5-ca52e0fc404b", "relationship_type": "indicates", "source_ref": "indicator--4e29502c-b516-412b-957e-3507473c4ee8", "target_ref": "vulnerability--17e83410-4ed1-4799-a0a5-0a947dd6da52", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e65045c-7400-4f15-a772-493075bfc521", "name": "Malicious Host", "description": "Web exploits: mitre-t1190. CVEs: CVE-2002-0953. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.152.186.168']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4a3a699f-e478-43d8-9b87-2b741bfc6a7d", "relationship_type": "indicates", "source_ref": "indicator--0e65045c-7400-4f15-a772-493075bfc521", "target_ref": "vulnerability--17e83410-4ed1-4799-a0a5-0a947dd6da52", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.133']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fbbec4c2-b90a-45d4-b8ad-2b1a3adbb61a", "relationship_type": "indicates", "source_ref": "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "target_ref": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f78eef58-ecf6-45b6-a2ee-da4397a27699", "relationship_type": "indicates", "source_ref": "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3b91e36d-69db-41c1-8051-314007f7cde0", "relationship_type": "indicates", "source_ref": "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "target_ref": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b53718d-e9a0-46b8-93d5-ec069014b0bc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.55.229.41']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ccdfd75-a8ae-4243-8ca1-c134b964849e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.173.118.68']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8ff1b0-95f7-4137-aee3-b02978aa8829", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51532187-bf63-4563-a16b-0e7911784499", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.131']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39e73e67-9933-4435-bf43-d565c84c827d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8477282b-5968-4816-821e-6895e4afc464", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.150.210.141']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c759204-f826-4d6c-a66d-37263f8336ef", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.154.78.93']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--312ed4c1-b6b4-4465-910c-4157c844cd21", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.127.148.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef15369b-d3b4-4834-bd6a-b7188174b581", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.93']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf80c23-beda-4214-984a-9c5c98da5f5d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.85.210.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57e9a2b4-d361-4c20-a04b-d3abd3f81fee", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.110.147.58']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--782d52ac-69a2-45af-810a-61120b75e185", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '223.109.255.164']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24e7a5c3-1f35-407a-ac98-e082aa6b877c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.94.155.100']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94467de-8da4-4652-a87c-a69a5bc33b8b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.198.158.134']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f42c210-92fd-415a-9655-502502fdfd5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '24.60.18.143']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c624ead-50bf-4b78-bc10-e2b686c17b8d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.150.188.148']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed7e6b0d-fca4-4b29-b706-b43c4a0bef6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.170.148.215']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d770bb4b-1430-42c6-a909-554ce63ce2bd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.22.48.15']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da4cd951-1287-4778-9191-b733997451d1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.177.97']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f173d6a-d67d-492f-878c-32004258bdc8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.56.19.98']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--624a527c-0cd1-48c5-94d6-1010e39eb60f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.70.64.154']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a90732dd-db3a-425b-998b-40464102042a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.0.41.251']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.136.179.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49bbe6b3-7386-4253-8622-672d95f0f50b", "relationship_type": "indicates", "source_ref": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e0b495af-a492-47bd-aead-c47169c7027d", "relationship_type": "indicates", "source_ref": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fec85b3c-ef40-467e-99fa-831b933ab073", "relationship_type": "indicates", "source_ref": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "target_ref": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1288e145-51fe-44d4-b0ea-0be1c6b2c2c6", "relationship_type": "indicates", "source_ref": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "target_ref": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a6c3c07-4632-43ca-9f81-6c41919737de", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.138.226.105']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f64b4315-33da-4b90-a51f-1b43a8b763c6", "relationship_type": "indicates", "source_ref": "indicator--7a6c3c07-4632-43ca-9f81-6c41919737de", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df5ecadf-3502-44b9-879a-fdceed721ef2", "relationship_type": "indicates", "source_ref": "indicator--7a6c3c07-4632-43ca-9f81-6c41919737de", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1147aa07-6626-4658-8a6a-889f5d31e9a7", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.139.239.220']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--737d9ed0-4b35-48c5-8b3d-6e143ca2c266", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.41.194']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.14.77.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81d9074b-ef30-4706-bf8a-be7ece4817fa", "relationship_type": "indicates", "source_ref": "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f9b11e43-283d-465e-a9d5-ae59aad5f578", "relationship_type": "indicates", "source_ref": "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc1d888d-77fd-4891-a10f-f5e48a3b4976", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.112.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e864f5a4-0ed4-44f0-a8a9-9b61e02e59a7", "relationship_type": "indicates", "source_ref": "indicator--dc1d888d-77fd-4891-a10f-f5e48a3b4976", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--35c22860-e30e-4f23-ae41-fb95926d8d86", "relationship_type": "indicates", "source_ref": "indicator--dc1d888d-77fd-4891-a10f-f5e48a3b4976", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdfa5093-4c50-4483-92c6-3d23db1a3284", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.164.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--618432ea-2137-4fe1-9e53-fbef2a5baa18", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.213.172']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0336cf7a-7c81-4b21-9e4a-dc1886ddaa45", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.234.80']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--badbff7b-e3e4-4015-97a4-14ddeaeebb48", "relationship_type": "indicates", "source_ref": "indicator--0336cf7a-7c81-4b21-9e4a-dc1886ddaa45", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a1fe6524-4cc8-4422-90ee-a8420fcf8e05", "relationship_type": "indicates", "source_ref": "indicator--0336cf7a-7c81-4b21-9e4a-dc1886ddaa45", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f10cf7f-bd46-4de4-a35f-589b3b88e458", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.124.234']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d1540d01-7f95-4b97-a099-70acf5f3406f", "relationship_type": "indicates", "source_ref": "indicator--6f10cf7f-bd46-4de4-a35f-589b3b88e458", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--501d322a-5aa6-43ce-9a46-944237311660", "relationship_type": "indicates", "source_ref": "indicator--6f10cf7f-bd46-4de4-a35f-589b3b88e458", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.181.0']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a42fc39b-3839-4c06-a363-417fa45f8351", "relationship_type": "indicates", "source_ref": "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--efa2d6b1-c27e-4b1e-944a-290468fb9e67", "relationship_type": "indicates", "source_ref": "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9dbb6396-cecb-44f5-9389-3df5dc182d49", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.48.166']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e0bfaba6-2a1b-4a52-9646-12a305df392b", "relationship_type": "indicates", "source_ref": "indicator--9dbb6396-cecb-44f5-9389-3df5dc182d49", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--63933ca4-fc5b-4d5f-b227-c5225df88e7e", "relationship_type": "indicates", "source_ref": "indicator--9dbb6396-cecb-44f5-9389-3df5dc182d49", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e98863e-604e-4d91-8366-fb6a39d66c2a", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.60.160']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df3f04cb-b2c1-4c59-ab74-4e2ff5547819", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.141.81.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd604ccd-bb03-4cf9-9b91-5c833e57d7b5", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.140.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6076f79f-516a-4e9b-ae63-0684c92eeef3", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.193.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--59c7a7df-70fc-400b-bf9f-e09faed1da7b", "relationship_type": "indicates", "source_ref": "indicator--6076f79f-516a-4e9b-ae63-0684c92eeef3", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d7c41ddc-9cc9-4c1c-a34e-19a0269d3a16", "relationship_type": "indicates", "source_ref": "indicator--6076f79f-516a-4e9b-ae63-0684c92eeef3", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.219.75']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cca10916-ec0f-4f72-a0c0-e7ee91e22ab2", "relationship_type": "indicates", "source_ref": "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--51322d08-abe6-491a-9d11-dbad5aa68b3e", "relationship_type": "indicates", "source_ref": "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c864f726-11de-4237-83a1-5870ac8c95bc", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.142.222.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--12e20880-f3c5-4aed-9f32-3a3cff98df35", "relationship_type": "indicates", "source_ref": "indicator--c864f726-11de-4237-83a1-5870ac8c95bc", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5d724c31-1367-4024-b457-9721d24f065e", "relationship_type": "indicates", "source_ref": "indicator--c864f726-11de-4237-83a1-5870ac8c95bc", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--800a5379-bd37-4186-938a-edb91c80134e", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.146.194.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c31da74b-b2d0-4740-8270-015c751a4e6c", "relationship_type": "indicates", "source_ref": "indicator--800a5379-bd37-4186-938a-edb91c80134e", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8139775e-bf85-4a18-a157-4983b2cd4c6a", "relationship_type": "indicates", "source_ref": "indicator--800a5379-bd37-4186-938a-edb91c80134e", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae26ef94-c75d-4618-b86a-b8be2609640c", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.22.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38cceeed-f9a3-4142-9870-d60a69f466c7", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.170.164.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b9bf0df-8706-41c9-8aba-eb9dc73af8b3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.26.214.41']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3150bb-30f8-4daa-8a52-e8a93613e925", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.28.117.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dcd4594-4cf7-4261-a6dc-1fb530e97820", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.47.43.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dcf12ded-93b6-4bd2-bd60-a60d9de2346c", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.133.111']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dd5c76c1-742c-4ab7-82d9-7b2b5a316285", "relationship_type": "indicates", "source_ref": "indicator--dcf12ded-93b6-4bd2-bd60-a60d9de2346c", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--81e2c3f9-b09e-47a1-b771-0d6f98431134", "relationship_type": "indicates", "source_ref": "indicator--dcf12ded-93b6-4bd2-bd60-a60d9de2346c", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00c03ab5-d4dc-49bf-8580-afc79090e711", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.150.124']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1710110-6a9e-4427-8a28-e8246647c53f", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.229.253']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf6f08d2-6d8f-46f8-8ed3-228ad5e7856a", "relationship_type": "indicates", "source_ref": "indicator--d1710110-6a9e-4427-8a28-e8246647c53f", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5dcb81a6-49da-4f34-92a8-3859d0ada4d7", "relationship_type": "indicates", "source_ref": "indicator--d1710110-6a9e-4427-8a28-e8246647c53f", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8e0ed95-cea1-4d48-b2ed-4abbefebd7e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.25.61']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.46.142']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6fc295c9-c63c-4a37-8149-1d55c501e723", "relationship_type": "indicates", "source_ref": "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6860737-4e4a-44cb-979a-2fb89328889d", "relationship_type": "indicates", "source_ref": "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "target_ref": "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb5dd83c-7069-483b-ac14-8a76294bb59f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.241.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e78f342-7799-4922-a5f0-56a7bd86c7af", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.79.59.9']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--75880b64-f70b-4414-ba19-6eb2fd9271ad", "relationship_type": "indicates", "source_ref": "indicator--9e78f342-7799-4922-a5f0-56a7bd86c7af", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4c5bf13f-c2fb-4403-a1cd-b72664df5e0a", "relationship_type": "indicates", "source_ref": "indicator--9e78f342-7799-4922-a5f0-56a7bd86c7af", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7cb15031-2490-4a8f-a133-16724979b187", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.86.206.152']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44bb4fc3-4720-4fa6-9b7e-a9e85977216a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.28.242']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3298ac35-5ca2-49fb-ab6c-b7e69112ff18", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.229.134']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7f87aa4f-9ab1-4080-8f26-dd400a649865", "relationship_type": "indicates", "source_ref": "indicator--3298ac35-5ca2-49fb-ab6c-b7e69112ff18", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--02f0cc17-94ed-4e8c-a154-14474ffad6bd", "relationship_type": "indicates", "source_ref": "indicator--3298ac35-5ca2-49fb-ab6c-b7e69112ff18", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.254.119']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a24a5a7a-21da-4fc7-a71e-2a257b406a82", "relationship_type": "indicates", "source_ref": "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--885000f0-2ed2-433e-967b-3ef1b9740e7f", "relationship_type": "indicates", "source_ref": "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--319d2c8a-5184-4bf8-a55a-4566e7a3d917", "relationship_type": "indicates", "source_ref": "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.132.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--53515600-e2d3-477d-9801-a55553fbc217", "relationship_type": "indicates", "source_ref": "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--03d24d13-2aa3-4038-9372-43f0792d5552", "relationship_type": "indicates", "source_ref": "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf020cd7-91de-4f34-b456-3908956d1e3d", "relationship_type": "indicates", "source_ref": "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.241.239.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d6b36c3e-1e37-4498-9625-306b9430a395", "relationship_type": "indicates", "source_ref": "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b6338de6-6422-4e64-b684-267be9245b0a", "relationship_type": "indicates", "source_ref": "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7adb18b5-5c88-4f12-b851-73ab7608be91", "relationship_type": "indicates", "source_ref": "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d21dbb-20a1-4ae6-90c6-d55107ab685a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.134.208.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6ad65a-a219-4c9b-a526-03c0d6dff073", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.141.93.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--713533b0-2a0d-4ed2-92d0-9e51777b12f1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.67.227.241']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06b84e7d-565e-40f4-845d-ed5614b52ed7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.94.25.170']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--662ad891-fb31-4078-813b-ebef6489396d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.36.135.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c97393e-8c8e-4ff9-943d-99c37674d084", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.19.36.114']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f43a480b-c3dd-4515-b8da-7da61c69c056", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.190.143.51']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d59db5e0-9e6d-48c6-8aba-4469bbbc1f15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.32.139.248']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--809db237-c173-4514-81f5-ea997ca303dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.34.190.55']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9968fbb-ce76-4316-ac24-29cf31b69c39", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.34.191.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbc09f58-86f4-4998-8d68-c02e4ee80928", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.74.77.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbe62e76-985d-4c15-b70e-1b67d4e79507", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.83.95.41']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15c6f294-3a2b-4e5c-8946-4ed1860d74b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.209.10.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0457413e-b94f-4e28-852d-f999de4d5135", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.211.140.52']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bec4f9f-be23-44fe-bcc0-c76968a7720d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.56.251.50']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e889f01-7b44-4232-a943-00a7fd7050e1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.93.28.23']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5f49dd8-0638-4fc8-a221-864d40919e0e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.99.32.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1813845b-d1f1-4e2a-8208-519d4e3908ab", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.1.65.89']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f97057c7-7a7a-49d0-bef1-2fd5181e878b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.227.139.105']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f1ae6c4-f336-41fa-b55b-0521df9d1125", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '42.83.147.55']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e19ca9c2-1965-4331-ac7b-5e553180bf62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.42.119']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abe07724-eb9a-4490-bf05-3ea9aad4389a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.1.43']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507bcd4b-451d-4059-bae3-79eebf940fea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.102.223']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b444f0b3-8cb0-41cc-bc64-11d4db376d6c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.113.109']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1521f72b-0871-4123-97ae-082f9dc75b78", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.113.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca207c6f-d3e2-4ffe-afec-123441b21d7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.119.85']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db57034-5c37-4aa0-ad0f-eb49558ca155", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.154.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0a29bd0-fd03-45e0-9c4f-c9b60b53d81b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.39.254']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9554d10d-9939-4c72-9aa5-fda296bde6f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.62.99']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2d43d13-d1bd-4607-aaeb-62b43aa17700", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.72.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--625825bb-c852-4468-92c8-2c42b2132df3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.26.176']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c87175e7-384c-48e4-a78f-0c629cd2a4f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.36.84']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bff41eb-cc79-4f7d-925b-8b4eee87c992", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.56.170']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--950090fb-be00-40a8-b93f-85a600213571", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.214.228']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a07bfc23-b936-4365-ae84-e66eac2c893c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.7.21']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--291d13bf-932e-4c29-99b2-31652077c3ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.196.236']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04824ef0-1ca4-4fc0-9f50-92b96939cb10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.51.221']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d6fed61-b45e-43a0-977a-fa52e7b2e9aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.56.214']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c836827-cb29-415f-9fb5-145f13267f3f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.85.158']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dde5a092-a020-432f-a845-000985bc2608", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.33.217']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1eb1309f-ab37-4bc5-bbf8-2b5736fbc026", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.36.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8de2c4bc-ab5d-4ea0-af1a-8e233cd05cae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.49.100']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84443e5f-92ba-43f0-b472-55ebb50f25ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.140.247.223']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d2f5fb3-7cb2-4bda-847e-12b04520bda8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.143.228.238']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e8ac16f-89f9-42c4-9539-48c83f336530", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.19.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d47757ba-bf6c-4ecb-81c4-638454013bff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.33.59']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bebe372-2946-46de-b595-60ed4aeeb063", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.36.110']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfd60f0d-cc27-4402-ad7c-6626dd04c16e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.37.130']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6051165-bf7a-4fc2-9713-ef40a765dc8c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.37.176']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6483919-f6a9-464b-b431-283b7919ba76", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.62.239']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04c52b36-4b69-4f33-9f40-0a6b1f00785b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.73.189']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0629bcfc-7b33-46a6-9e94-f1ae1e633924", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.81.109']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--248ec13f-27e8-4ea4-9a7b-d07549ce007c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.13.113']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c4b0023-73df-4c9c-838c-82e2e7c02aee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.188.29']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa4d7740-d58a-4745-a0c3-f7ea6f58ffbf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.108.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83d62693-8b9d-47d8-bc08-a2838e94be08", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.158.178']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e9a2bb-6505-4123-98d8-d26691c13ad7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.180.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2eb72400-e3cc-43dc-8035-748fdd91f8e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.52.37']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0966484d-878c-4074-9750-fce41172a896", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.65.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa05a118-e2ba-4055-8c1f-76cc087ac623", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.143.187']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d9c83c-cdaa-4842-af6c-8e457798868b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.62.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3939bc3c-3386-4608-9f7e-467af5c15ded", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.160.204.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f2821e2-2f3e-4fab-a152-f1bb882fc976", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.103.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25d5ba0a-74d2-44df-bfa5-91219a6b2a3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.105.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6371ee57-21b6-4822-8f7f-ceaf6fab9188", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.6.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a0230a6-cab4-4a03-af1c-8e57352fae31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.170.113']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98701eb2-eb68-48f0-8425-43009f0f1a4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.252.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa0fbd07-eadf-4ea3-9def-355951ba292e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.172.197.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--172dcaa5-a53e-46c0-8aa6-c6108a683553", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.132.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5ae0421-f746-4aa9-8687-7edc3cf5247a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.173.165']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8fe7795-ff65-4f0c-8be3-d041fe18f51f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.175.139']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dec0bd7e-18ea-45ff-a242-d3ca5c4a0997", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.153']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff33bc89-3c9e-4077-b237-8df4cfcfdcf7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.206']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3960298-5a93-4c43-a6f6-79a65843caf8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.233']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6907cd88-8c10-4a69-bfe4-7f20f264af4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.77.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a1cbcec-21da-4821-926f-6c5b5f109951", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.131.193.146']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53ffad11-ba61-40e8-a09a-41cad1cc677d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.136.117.21']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d7eb82-0656-4763-955c-56f252f7acb7", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.185']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e774a2bf-3a49-4507-8a4d-3817f90d7bbe", "relationship_type": "indicates", "source_ref": "indicator--31d7eb82-0656-4763-955c-56f252f7acb7", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c544ef0-84dd-4344-a80c-b35107febd27", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.26']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c08f177e-6069-44b3-a8e2-e8d0ed9ec989", "relationship_type": "indicates", "source_ref": "indicator--2c544ef0-84dd-4344-a80c-b35107febd27", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--14c0fcfe-b6ff-4e3a-9a32-3be9e5da2fd1", "relationship_type": "indicates", "source_ref": "indicator--2c544ef0-84dd-4344-a80c-b35107febd27", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e2a0f85-1081-4f1c-906c-ad545e0dd486", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.140.53.203']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fda814f-8046-4ee2-8d2f-c41484febabc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30cb9cee-7851-4a33-b51b-156acc6566da", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c51a677-e834-4166-ad76-847934900709", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cb36e4a-b63e-4c7d-aa67-e6009de4fb11", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac1652a7-9037-4f71-80a2-1b948af0b30b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.240']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8631be58-8110-4a54-bab5-c58eec2746e9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.61']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--40583a56-f5fd-4f99-88e0-69fdadd73f02", "relationship_type": "indicates", "source_ref": "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--354554ea-b930-4bb1-8e7a-db5d5c01bad2", "relationship_type": "indicates", "source_ref": "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "target_ref": "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f91f2b89-891a-48b0-ab80-c79e50c20d18", "relationship_type": "indicates", "source_ref": "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8a9c0dd-145b-4831-9de9-1476ee71da83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.163.169.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e2f8f29-ba4a-4a5b-8a28-305414d37edc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.169.27.160']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7991fe5-1cf7-417b-a181-693363e59c5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.170.226.129']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d9558f4f-16f1-4ca8-86c0-080504ef4665", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.172.240.119']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6745062c-15d2-4994-9576-6a0272dbc74b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.174.108.144']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a06994d3-6471-4ca3-9216-67a89a53fc58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.181.114.87']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66958272-965b-4cf0-93ac-7a6dd1d398f8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.183.155.80']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6035f184-d327-4731-b840-7576782d2eb5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.195.221.26']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f363b887-923e-482e-bf4b-d9941bb83776", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.231']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf84035-c24b-47ef-bd6e-32956b683275", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.207.209.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdca2a66-e77e-4437-ba0c-4e4a9219bc41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.224.106.127']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--beda0b8c-2ee1-473e-be4b-17a9f9bbc7db", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.237.92.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--481ca6db-d4e8-446d-81fa-eb0179f409c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.3.33.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "name": "Malicious Host", "description": "Web exploits: aws-credentials, spring-boot-actuator. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.45.237.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1e3e654e-0d36-472d-b845-b9090d0a2ffd", "relationship_type": "indicates", "source_ref": "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--29051a49-8bc3-43f1-b5b0-8acc1d7bf602", "relationship_type": "indicates", "source_ref": "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "target_ref": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f20ed681-f4d7-4e10-9737-e1cda1e28984", "relationship_type": "indicates", "source_ref": "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "target_ref": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6514c7d2-4728-4b4d-8750-9002fc0d459b", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.55.186.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443f97a6-9635-477c-8d18-02cee3b3a7ce", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.74.0.223']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56dd400c-2acc-4b23-a091-0dc3af5cf057", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.74.3.196']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d04500-7257-47b5-843e-602f4f038a0a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.86.186.173']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a87cc60-dd5d-40d7-813c-e893c2dace9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.117.193.147']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbfc63cc-583e-4eba-ad23-aca5d23ddaa2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.147.156.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1e3b1c2-c79f-4e2b-a1a2-b7126b91b53b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.148.135.252']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--240a45b9-727e-4e33-89e3-92d40b6a0b9a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.150.89.117']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de1dfdfe-d8a5-4acf-a29a-7342b176add7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.161.31.60']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f646238-4513-4d79-a328-acb742f84cc1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.200.251.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96df7a30-2c4a-4f0d-8543-274566e6fb23", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.201.25.192']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f38f5c71-a992-4c67-b29d-b7dc3b3023e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.250.169.45']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24617e1f-cda2-46d2-9c0a-1fd5ed6c2ed7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.250.172.244']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cab08e8-327e-4393-895f-671cd37d2d40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.6.126.238']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd1a83d-7e32-4ebd-b320-b1079d998ed7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.8.155.230']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa6cbe2e-61b7-4b31-b5b9-6ae7888b8855", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.106.35.158']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c22dcd6b-3221-4a42-908f-a543e19b7fdb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.98.144']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e6651e0-3c2e-490b-b74e-1dcf2bb2bfa9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.224.206.51']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--600c110e-7b47-4ebe-a619-7ab66b59d963", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.228.211']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d88a7990-c8e4-4019-9456-1b78a50e1975", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.79.13.47']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4edc68ca-6c0f-4ab2-8c89-6e0691d87411", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.231.192.36']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00c96615-da60-4172-a75c-6b123840a532", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.195.195']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7e93db8-010b-46a2-86a6-195b9fc4a487", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.243.156']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e981895f-f088-4a49-85be-6109f4e9a365", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.72.212.22']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126bbaad-5254-400c-85af-68a85b15b41f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.31.179.125']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5ac0dd6-1822-4dac-a9e1-4c2bdf0f670e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.36.80.162']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--936514f4-7de1-434a-8dd1-043ae4ea6cdc", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.39.125.103']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1d7557ec-5d62-4075-a15c-12c806aec621", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.77.204.60']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--303d9a71-359c-4c52-9d49-fcfeab1f832d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.6.241.208']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8355af5a-bb81-470f-afc2-7e796b8bba09", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.161.136.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549a2b40-a770-49d8-845a-4e85cbd8971d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.195.149.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad2e37d2-d1ca-4203-92ca-50d0eeefc255", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.225.143']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec3a638e-0781-435f-b862-d5da310c9a6c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.68.151.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8973c72a-987c-4298-9a90-794f069cc101", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.146']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4f24989-fd1f-43d8-b6a7-a744c5c82f5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a01c7556-7ea2-4b6c-920a-701eff2bfea2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.131']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43460615-245e-49e4-903a-71192c5b778d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.111.65']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71f8ec98-ee56-47f0-89ae-01600fcc49f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.141.3.247']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f18a322-7c1a-4058-832f-2c5734f46af2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.38.109.115']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e9d42c9-ad92-4203-a396-54432996a76c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.39.136.48']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb659d5a-445e-4e44-9571-3c56519da0da", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.39.184.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d45d48-3947-46ae-831c-ff0e2c8a0bb5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '56.10.97.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c45ee5d-b5db-46e2-9879-1eee9b6d9d35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.0.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad0b0a8-6bbf-4cd1-a957-2159309a638b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3d836b5-25a8-4c68-90ad-669a469c1586", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.39']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a0259c5-816f-4aa6-a2f6-3673ea3243f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.47']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4cecc52-c560-473d-b346-9c5585060024", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.6.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--736ce219-a83a-4f70-b67d-7279c7d5e04c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.186.20.101']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5382f53b-f385-45cf-9f3d-8d4e66acf299", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.249.195.26']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a2a2d8d-a0a8-43cf-84da-a94dac250ba6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '58.255.64.117']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ed3200f-2348-4ed2-8033-92907d4359ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.103.109.252']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bd0faa5-3f1b-4d1d-b199-a9b3641b81c0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.36.211.132']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4f14281-a2b1-4344-8edc-056d03321560", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.73.49.174']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54bd5eda-32b3-4f31-b131-497e6cd7ee5b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.217.151.226']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c787f0b-cc9f-4247-b65d-0162bf00fdeb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cf6044f-0d93-4fe5-af40-5f1f6a865c4f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.242']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f14a46c8-fd73-4558-af37-1707414b0f4d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.249']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f6515007-2f7d-4bf9-9c02-679cbe4c378f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.253']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5b6b19c-f307-415f-81c8-3e865582d51e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.159.78']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4008649c-698c-46ba-a059-46a1882cbb72", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.161.90']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46bb7705-709a-4b4a-a000-2f4d228efb23", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.128.34.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--902aa625-76f7-41ed-8f23-53c5498ffc76", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.179']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17effbbe-5451-4b90-a637-39fe40e26f51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.68.162']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70d328a8-0898-44a0-9a74-f919571856b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.68.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63ae64f7-f346-4cb8-b354-3b2d6f4d9e1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.68.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec14b4a0-833b-40d3-90b5-2ab7c696fe43", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.68.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9b3064a-a2e5-4b72-8b73-d525efce2c0f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '70.120.203.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dd72e1e-925b-414b-ae12-51a11743c0e9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.77.19.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--abf5fa83-5562-46bf-80c1-76796554cc5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.125.150.164']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f444dc2e-c446-4136-b16e-da4746fea35b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.175.162']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ea5503b-3dcf-4346-9c39-5b2421553902", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.227.160']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27913063-3b9d-4a12-9bcc-596ffe974198", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.57']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7e6f8ea-81f1-484d-ba6c-6079d70e3c2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.29']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b71a2930-b85a-4872-b58a-75afb383b976", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '75.119.156.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9309a27b-012d-40cf-a25c-4fbdc51a359f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.143']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edd4f252-edc5-4586-b62c-1164f714fff4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce72a666-ba0b-453f-a949-bd9836f2131f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.12']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e128cda-9d3f-4323-9a75-d2978864c396", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5c500a4-e565-4943-aabd-e2c8d0adf0d1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.5']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c0889d0-2e77-4227-b51e-e5a92e0d2ab4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722e4dab-cb5d-4000-8acb-25d9351b2127", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.10']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1af9326-66df-4c3b-b91b-9703268f6d6c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.100']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--960ac4d5-1327-4efc-8905-1ba9e285fdae", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.101']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1fa120d-5cce-4641-95a6-8d07ff9f63dc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.102']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6bef82b4-a8c1-4120-b2dd-e4fae5c146ec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.103']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b564937-22d3-4941-9a19-cdcc15963a5a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.104']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--734bbc56-34d8-4f73-a1d8-8d925875b3d9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.105']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--587be777-de04-4452-9c0f-03131f0f45bc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.106']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a74d5828-001d-4fa9-a168-5f4ae39fd3ca", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.107']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aac18d73-4b59-4b52-9470-3f361b23ee58", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.108']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e998fafd-d0fd-4e0d-a315-af101945ff3a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.109']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17d8678a-9114-43f0-b3d6-a72383e5a242", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.11']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c6e896d-0c61-4d8d-8f56-885e4bd21dca", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.110']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5313dd7c-1971-4fa2-85cb-802c5a313b0b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.111']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8207014b-edae-4bdd-94cb-4d97b4d2200f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.112']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c1298424-6185-4192-8d71-ac6eb99da377", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.113']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0b01d77-eaa7-44c2-80f7-509c9cab6076", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.114']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8c56c4-fcf0-4f29-bf1e-4b317d916499", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.115']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c82b72-94fd-459e-a419-9bc067ab9c39", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.116']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e145830b-df83-40f1-a3f5-6be75e48d91e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.117']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60db1dcc-04d4-4685-8f36-a5ac20a9af1d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.118']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e276d8d0-d295-41aa-8530-f7b0ba3e1aed", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.119']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7dbd0efd-9ff9-4cfc-b955-0d55cd42dbe6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.12']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01bcece5-25cc-4f54-99e3-eacbe8f78e05", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--493f3579-6cab-470b-94f9-7bcaa02aebcd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.121']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed40f5c2-41a1-4cf5-bd33-3efe7df612c4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.122']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8632f3b-a75d-4857-ab8c-11c2b6fefd0f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.123']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17598e4e-0651-414e-a07c-37cb5a07a58f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.124']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42b2c18a-4618-4133-91de-d298c4aac681", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.125']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4039bce-e70a-4132-81c6-cafdcc1ca8f6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.126']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--663f33b9-5972-459d-96c9-f3078a0b208b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.127']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93ea6420-6816-4656-94ae-51f1a48e17e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.128']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66e9b636-6958-4e09-81ea-efc8761ea533", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.129']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdb745a2-5b1f-422a-9b0e-be226dd73a60", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc421d7d-ee5c-4ed4-8a79-4bea5fb98b5a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.130']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a0480eb-4b9e-4ed4-b95d-08b05db6aeae", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.131']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec4e40f5-2452-469c-971f-d920c9b36ef9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.132']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7dec1f8-4827-4001-83fc-87d0d3ede9b7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.133']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7f19adf-9c17-41b6-9613-3184dfa6d2fc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.134']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dba7cfd5-f866-472e-a3ed-7971f373b5b4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48102b12-d2c8-43d6-8fd6-a68df20b2dc5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.136']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc8bada5-d698-458f-a5f7-663260cd5049", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.137']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc9483bf-11fd-4458-a744-e28d863686e3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.138']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b9e665-9b8f-42b7-977f-1906432ec747", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.139']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f273109-8fc5-4e74-80a1-948e3f6ae6a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6f38ee-bafa-4476-a9cd-14b8049da61d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.140']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27a5cf16-5395-40b1-af0e-f13ad8701ca9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.141']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a32b7ebd-542d-45b7-b13c-74a1721d5bea", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.142']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad489a80-b918-47df-a422-dc9b385e0bae", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.143']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a95d342-337a-4cbe-96db-7dd353914c25", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.144']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f0e40a4-377a-4ec0-bbbd-630be0a95a39", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.145']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--616a4735-8cbe-43e0-9dfc-97ae5407adb2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.146']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7c491a2-f6f3-48e9-8622-cc6045c94b8d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.147']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--041f0b63-0b91-4390-8837-39c06fc745f3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.148']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e5d548e-d0ab-4f0b-8e9a-4147aeab2baa", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.149']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48809359-0fbc-4a12-8983-c321b66ccfd6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.15']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84f7497f-8b25-4c96-9952-b7099e077fcf", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.150']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e300c77b-cfbb-4c4f-8e1c-f95b5cd83c15", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.151']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b32c7f92-1b3a-42cc-9df1-620da78dba34", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.152']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8646d4c9-a294-4583-837d-af0833403e67", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.153']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52c63502-bfc3-455d-adeb-abcb3a73a9a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.154']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c20f5a-7674-4687-9580-961b33e0540a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.155']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd104ee-c034-428b-81bb-29eb29ff4612", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.156']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--399c29fa-79df-4b02-a361-2e327230f5b2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.157']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fba2ba13-e2a2-40b4-a958-65a969b75c08", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.158']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7edb48f-2001-4814-910e-d5f4d32c98da", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.159']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af038440-341b-4605-b129-b37820b44e7b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.16']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--348c3e3f-7131-4ff9-826d-a0538d0a422a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.160']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65199216-19e3-4f0d-9aa5-3f8fe19b4231", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.161']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7db9f110-4166-47a3-93ec-fa49e52ed862", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.162']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57ed8d25-5246-46b4-8ca8-4299e7f25b38", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.163']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6e7282a-4fa8-4543-9c4e-4db396eb6c51", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.164']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65310fb4-798a-46e6-b2e9-7fca58e06dcd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.165']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--363c99da-3a3b-444e-add8-b923cfe90838", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.166']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246c787f-4bc0-4bcb-aacb-859b388e2bbb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.167']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a473ac1a-128c-48ff-925d-77cc6fb5cce8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.168']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ff2d538-6e9c-4306-b71c-d04f4393333e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.169']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--af3423be-a2fd-487b-a66c-e17a794f64a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14a149ed-4892-42a2-83cf-f1702f621aef", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.170']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2941b2c-661b-4c86-950a-8cd7e5ad91c1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1034f19d-3c31-42fc-a47f-165452bdcfb9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.172']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a71af3f-9f84-41a0-9c75-4af65053fc98", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.173']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcef7f0e-07da-4b60-a893-b03ac1da7fe2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.174']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60ea8249-837b-4f2a-b1f2-b07583104bf6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.175']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68832095-7225-4da9-a0d0-bef757abd634", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.176']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9aa1e85d-66bb-4990-978f-dc93b9272063", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.177']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56c303d8-abe8-444f-ba4d-24a03435d085", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.178']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--714f4dbe-375f-4000-abcc-ce202e262011", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.179']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21a1e2b7-150b-4131-b9e7-51cc56f63859", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee2e22e6-d214-4bbe-8a38-ae61d75228e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7818e279-afb0-40f0-ae34-dd266733afbd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.181']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69338062-5fbb-4511-b5d5-70813ca2e0ff", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f765fe5-95eb-47d3-af55-ff817881975a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.194']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--046bfe0b-71be-454d-a89d-9d5be4820d92", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.195']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4aef7a9-7512-41d3-acd4-6deca9d9dc7e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.196']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d8d0026-5cf7-428f-8c42-03d820b4db8f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.197']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13c1bd49-8718-4af4-bfd5-aa7a8f9d94b9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.198']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87807bf1-f7a7-478c-9cab-8225af91e390", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.199']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed982f88-5cd3-4448-afa4-8105db4c15ec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.2']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e545ee2-ed7c-4d1a-aa77-b0b2ae058d73", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16c1253b-c7a2-4d22-87ae-17e085bac032", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0cff831b-94b9-41b1-b815-c18133901e4d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b956d4-acf6-40f3-ab5f-dfeaf2c8461c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.202']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3df93ed6-5332-48c6-a804-0d6910e99e62", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.203']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--911c238c-11ef-4983-9495-60e6c2eff364", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b666d482-7d33-46d1-86c6-45e741662bd0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98fa08ff-5328-4649-a887-e390cbe32388", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.21']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c208a117-8598-4226-90f8-8eb9c62f474f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.22']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e8776ba9-5372-44ce-b71e-7e2525f3b688", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.23']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a99723c-489a-409a-8b65-9ab2f300f166", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.24']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf9fe896-804a-4f4a-b353-824a3058456d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.25']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a428ee6-6158-49f9-91e5-e08b1143a719", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.3']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e96a5ea-b384-4925-8e0f-cc07abc4b409", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.4']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ba4dbba-0044-4cf2-815f-1000970091d5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.5']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b5df7f5-5a7d-4c86-a43b-53023fcf73dc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.6']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--532f01de-9a99-4dd6-8be0-d061797c6f38", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.62']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63099576-1f39-4558-8594-c1257c5bee2c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.63']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c8a2c316-5c67-49eb-bbd8-f9f6a9c349f0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.64']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a125fb4-67f9-490a-88fa-7821c6be69fa", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.65']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f260687-8574-4aec-a79b-b26524dd6cd2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6003f4f7-d8c9-4825-9e26-ef38f4ffb23f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.67']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3613e015-6e49-45d2-9f6e-9daaea108735", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.68']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e77f0a68-8618-4af9-b7fb-f63e69f2004b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.69']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--627908fe-15e9-4949-94a9-10ec28a98335", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1a1dbe3-078f-4963-9d75-49df50a1b18a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.70']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1dac47e7-5c0f-48ea-ac93-750f1bf76321", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b83b284-e5d1-423b-8c94-aa8d2e982bb4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.72']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fb368205-72e2-4f98-8679-269e70141047", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.73']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513bd9bc-52f5-4463-b914-2c774931fec4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.74']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ee288d35-32dd-41e3-9f0a-f6492f83004d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.75']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e69cc14b-138e-42dd-9044-d8785b618ac7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.76']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d212b7e-5478-460d-a7fc-0a646ece03b6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.77']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5dbc3324-5fe7-440f-89f4-9ac2d1ec7f61", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.78']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ddfcd42f-abb6-4fdf-bf30-3b2317a6f1f5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.79']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dfc73538-9138-4f53-bf65-4291be2317c4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72f1cc79-eaa6-448f-b644-1eb525b3bb9d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.80']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ea5b7fb-4332-4be0-8dc6-3a7fc3947204", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.81']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bb46394-ea2b-4542-a225-4372c41dde46", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.82']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acd3fd8d-0033-4492-b354-a4a5ad190f24", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.83']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4948169-d64e-45b5-bffd-2b0f525d3a39", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.84']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0996367-4fb0-42ec-afca-8c6005cbd1ba", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.85']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e55a0823-e471-4765-bdca-bfaadfad8c69", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.86']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97ea3b09-bfb6-40db-9257-2ebe41263d3f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.87']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd85e14f-925e-46f2-a662-836d4e30ac85", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.88']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f486b6ef-d4ba-4e93-a3d2-9ce963052628", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.89']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63a8f82d-e867-4d1d-8c86-adf98185f894", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.9']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529005ec-d5d9-4424-9ecd-a93488191ec5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.90']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a27e453-5ffd-45cb-bb25-c08566f93e41", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b613ed4-b4b2-48e6-a446-aa3cc46404a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.92']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--755ea6ca-cfd4-4407-86d6-3c54c6e6c2d1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.93']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62292988-0e5b-4766-a34a-e742be965b68", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.94']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--feaa700f-17c0-4e37-91e2-04fe1eed2a1b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.95']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86aa672-48d4-4118-b538-92538230e2c2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.96']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7202b519-a2ab-4b1e-80b7-02df96f5615c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.97']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--227d5e7b-420d-420e-aa95-cd0595962eda", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.98']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01a56516-83c7-4dda-970e-9c60d4388e1c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.99']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ad58606-53e8-49a3-bdbf-27d60276759d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.90']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4392e8f-ccd2-444b-bce6-4c74ce36045b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.91']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68dd70e0-7d14-4113-bb01-f7e28c0dc2b7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.134.49.171']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b162e8f3-9d97-4cc6-9076-c2bb79e38257", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.106.224.32']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdff1cc8-2921-4878-ac2f-c126c0d4e19f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.147.72.18']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d128dd3-a55c-4475-8cb4-703323667d17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.177.129.125']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a85fa23-8a5e-4011-a6a7-e8469f49f833", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.202.203.190']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a05bdde-9c3a-4c9f-b781-eefe7e5e33f8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.134.124.8']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--710dea84-fb6c-4b21-8b61-7037f3425e27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.217.145.188']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a971c147-a6ae-457e-ae5d-7d5c3bbab5ae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.229.169.46']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e970623b-4d13-4248-8d29-aa7d1bfc960d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.234']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '81.171.72.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a63f1675-8b4a-42cb-bd42-57aaeab3e994", "relationship_type": "indicates", "source_ref": "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "target_ref": "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e2cb219f-1072-45f4-952b-e61236df533b", "relationship_type": "indicates", "source_ref": "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b58d858a-4fe0-490f-accf-db0b6554b01d", "relationship_type": "indicates", "source_ref": "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "target_ref": "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--106c5ada-c821-4dd5-b54b-80db6cbe00f8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.193.216.17']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ecfc4157-6cd6-4082-bf8d-87f8491ddfc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.65.94.223']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20990b35-30da-4bb3-a51f-d059d95644e9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.71.101.106']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bdc89d-7cd9-4830-a3ff-4a5450905700", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.180']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--676aea94-159c-4cc7-8057-5c406466d4f2", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.182']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--410a8cf1-9a90-403f-a035-1017ca534cc5", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '82.102.18.188']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--754c17b7-79a1-46d0-b7d3-42e9c344bce9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.215.99.57']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c6ae8e3-50e3-4af1-ad47-2e182b5db463", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.226.237.130']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da91f050-42fc-4877-a096-18aa8a578fb4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.213.120']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e6e2482-60a0-4bca-9019-f7a36144c0a2", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.32.32.40']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cbb901e8-50f9-40f5-9e19-7958ea8fc5b6", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3955f1d8-0d6e-4706-bf3e-70d292e07f06", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.153.230.31']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0bb58f6-6ce6-4cc1-a617-80a7b221810b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.203.20.247']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d20ac705-708d-45a3-a916-3442c2f6e2a4", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '85.204.70.118']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e949b4dd-513c-49e2-8d43-bfb41465f76f", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '85.204.70.88']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0599ae84-e977-4f76-8d73-1558e89222bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7fde424a-0d23-49cb-b708-7a106013878f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ac553d9-361e-4837-9b7f-9016830e7e3b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c16fb374-3ef2-4357-8c45-c510bd580c28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9b30fcb-23db-48be-b21e-8e3b687beaa5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0444a18f-cc6c-40a7-86a2-93f29598b93e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7cd9d32-6326-405c-bff9-2c61de61bd40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06ba4cab-b882-4cf2-9815-f6c641604b6e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00416e43-3de9-4d04-95e6-c7f131b40ae5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f03fadc-8fb0-41e9-b335-a9a756c25c11", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0126bfcc-3842-40fb-9e69-4fed8d9d5149", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0274c21-eb3e-485b-8798-de6fdb9e78b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--549451f4-47f4-4270-93cf-07541eea1134", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6824a62c-cf69-495d-bce9-04870c28d775", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b2b559-e6c3-4130-a830-26d616664fd7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5fb3233-f676-4eb3-9376-10ba78ba2618", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c99b467-37c5-4bfc-9e0f-5ad20510304d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0e62d9d1-ba00-427c-8aa8-17ad977d8b88", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e032d22e-2caf-4b45-8d47-efc8925030f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5fc8acdf-2624-4be4-8e18-8813e5f63478", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--450ce257-a129-41f0-85f5-a8d34c4dce71", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.55']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e31c398-5bcc-455e-afa2-4771df4e3879", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.56']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0268561b-14d3-4a14-89cd-efaba7c4b22a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.57']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d90714d-dc6a-470f-a662-2acd650f9660", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.19']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6318fa1a-2382-4614-a459-b73fc173f31f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.122.30.157']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcc9cbbc-257b-4760-aa4b-996ae4ae67e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '86.96.61.224']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--433999fa-266f-495e-905f-4e269b3cf111", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '87.117.60.154']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--358509bd-0359-403f-86c5-462378024fa5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.180.206.193']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b5cdc3-07af-4da5-9603-c385a939570c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.185.88.226']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94e56fd3-c9c3-4bbd-8791-459a43df40aa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.205.172.170']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30d97eef-866d-47a7-909a-2094b767cb2c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.212.16.51']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe2bc1d6-3918-4c16-b19f-b959126b4db8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.236.190.79']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87256ec1-6bb8-4bfb-ac05-579df70c1a9e", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.19.215.95']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7feeee9-a699-48e3-bd4a-1d256c3744a4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.218.69.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb8e309-07c8-41c7-82c1-1ac8b1651fe9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.134.133.184']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--291924a2-2d7f-4602-867d-20c0f8906e6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.202.59.250']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c1cebb1-3060-4987-b685-d0240d4db654", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.92.34.66']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01282649-f242-49c2-a624-96b2276b5f72", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.14']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--633fb2a6-a4ef-48ae-90f0-74fdfec61786", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.49']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12604eb4-8d73-4b88-adbb-0131f91f3cb2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.50']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afbd4abf-f84a-408a-82f9-96baacf1c110", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.71']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d1bbc6b-1c34-4feb-8f2d-e7b435837b8f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.77']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49d86f68-b9aa-49c3-9517-5865cae3dd46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.116.193.99']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad6eb1a7-4c58-4f22-b957-ba89d8d77655", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.61']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4cf2be0c-9634-498e-9181-77c4c8050d9f", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.156']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--33381919-b5e4-479e-8f87-63ecdd123a58", "relationship_type": "indicates", "source_ref": "indicator--4cf2be0c-9634-498e-9181-77c4c8050d9f", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0855b8c2-1c7c-4d0e-aa35-f4d7827867bf", "relationship_type": "indicates", "source_ref": "indicator--4cf2be0c-9634-498e-9181-77c4c8050d9f", "target_ref": "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--354ef7b7-bd39-4eec-9093-3de61854641f", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.87']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e24e1a5d-c7d8-45df-9ae9-3394101ac9c0", "relationship_type": "indicates", "source_ref": "indicator--354ef7b7-bd39-4eec-9093-3de61854641f", "target_ref": "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a489af77-6af5-4510-94a1-5ad3d5f2d0cd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.57.131.135']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b376275-aa13-4033-b8b5-526e6af5e6b4", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.26.108.20']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cdbbdb8-c66f-4399-9a97-2a913ca20a83", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.59.246.13']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--687b60d7-cc36-4611-bcab-6adc8c2be9b8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '96.78.175.36']", "pattern_type": "stix", "valid_from": "2026-10-11T00:00:00.000Z", "valid_until": "2026-11-10T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-11-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38454da4-7917-48d5-9f8b-0e9124ac154e", "sighting_of_ref": "indicator--25f00520-ef1c-409c-8404-aa5b2b9b4829", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02f809ef-1d34-4ee7-bb60-218fce44c564", "sighting_of_ref": "indicator--fa8a5177-28dd-4478-a1ce-02116f1a570d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aaf5e51-83a9-414d-9afd-0df68d1b8105", "sighting_of_ref": "indicator--cb94db33-bedf-446d-b2ea-42e350d4e7f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5cbb36d-b4a1-435a-8430-aa10b85e5666", "sighting_of_ref": "indicator--4ab38cf6-a1ae-456d-9cd7-ddc0e82e29ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5676ff9c-282d-474f-8294-37383e134fb4", "sighting_of_ref": "indicator--67010d26-ed52-4c77-91c2-0f5f90e4c59e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c9ec65f-2172-4f2a-968e-c7645a1bf1f1", "sighting_of_ref": "indicator--af3f980f-f179-48ea-acd0-8e7c4932d821", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d558b97d-41fd-4b5f-9859-34365ecab8d6", "sighting_of_ref": "indicator--067adf25-db8c-41fc-b55b-46ed68ed4929", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f6b1177-79ad-463b-a9ce-e294323306d1", "sighting_of_ref": "indicator--cf808fb6-d415-4534-ba55-71defbe9f0a4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b146a1-a552-402a-8432-cd568e48f841", "sighting_of_ref": "indicator--00ec5cee-acb5-49ba-8893-93042306844b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46fe9fff-a441-4472-aeea-22f1e4d5af71", "sighting_of_ref": "indicator--7b27f4e7-58c3-4b0b-a56a-0cbe54786e02", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b3decac-5897-4c6b-a722-a129e2883ded", "sighting_of_ref": "indicator--59f5aca0-293e-4a12-ba83-7c65bf4c57a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c19ae74f-a432-4cbc-b871-732de51d1394", "sighting_of_ref": "indicator--03311801-30e5-4c76-9d6b-86aa0a5f2f90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8982c98-01f5-468d-b0ed-092cb62e747f", "sighting_of_ref": "indicator--3157b776-439f-485f-8770-2a8a54a17ec1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b303f28-19b1-4cc5-a300-c5843b46ddc6", "sighting_of_ref": "indicator--0b52e1b4-fa34-4063-95f3-3ebf6b23f412", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d71229e-4d67-4071-94d6-66c77403d0da", "sighting_of_ref": "indicator--ace340fd-bdd6-43ea-b264-10ff31046437", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c837394-f92a-42eb-bd5e-16f27f01c1d2", "sighting_of_ref": "indicator--b56af4ae-f042-47ff-af6e-dc0b092dc701", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1dd7ea3-ed75-4c03-9857-37c1909d5176", "sighting_of_ref": "indicator--09f7536f-91f0-4e97-8feb-fb564e99cd74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4ef223-20b2-447d-88ae-65dd60be5ce8", "sighting_of_ref": "indicator--29a56062-0c60-401a-982f-380b09ec5d05", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1f95d9d-b0db-426b-af87-e79f32b5fbdb", "sighting_of_ref": "indicator--765d0454-6d0e-451f-a939-cf7438dd544f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bde60fd-fe5b-4288-9c86-4ace2851850e", "sighting_of_ref": "indicator--82b5fa67-8644-4ef9-8b82-befbe404b7ba", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec9bef37-369c-4d22-af9c-bf26481623ca", "sighting_of_ref": "indicator--3bf1c33c-fdda-4009-b229-a189f9a295ef", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d28511-209d-40ff-8295-b5fc1af08c01", "sighting_of_ref": "indicator--2fb3a81b-e2ea-4b64-83ce-985501399779", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf101711-b026-4ec4-8010-5ad8a544020e", "sighting_of_ref": "indicator--765aaf70-aecb-4e44-8d8a-6a65f3495b20", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4725186-fac2-4529-af18-aae4bd4fe5a6", "sighting_of_ref": "indicator--20bc89a6-b247-4ce8-8b13-b9f5884c87ba", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b00d49ff-5515-4764-b938-9cb80fd087bc", "sighting_of_ref": "indicator--ee94b853-f1ff-4a1b-9766-3ea2e9b55bcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f408f769-afc9-46c4-881d-67d8fe94d607", "sighting_of_ref": "indicator--96e6d398-452b-4e1e-b279-6a9f0eaabaab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0686d61d-cedc-4241-8e97-82bc6b76a977", "sighting_of_ref": "indicator--27010ee9-0e0c-43f8-abff-620d1968e716", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--162ab99b-2306-4071-bd8b-ac084f7aca75", "sighting_of_ref": "indicator--8130436e-aa9f-4878-a348-9bf682474685", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--643bc6e4-5fbf-4806-b21b-6f0017b50806", "sighting_of_ref": "indicator--3d2fa439-c56f-4851-9ae3-8b9dc42b4863", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beffbd40-2dbc-4946-9ea9-c1619f1a3be7", "sighting_of_ref": "indicator--e850d505-1f73-4cab-bad0-18fcf520a4f3", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71505eff-8b2d-4549-b281-05f8dd83f947", "sighting_of_ref": "indicator--f64e017a-f8da-4346-b30d-e628da189540", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--234a5c16-8308-43ae-bf92-edfbdce702fa", "sighting_of_ref": "indicator--54b093f3-f0aa-4818-8269-a5100259d2e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--defed200-9a78-4816-ab65-173db98041d8", "sighting_of_ref": "indicator--7ea7b23b-cc08-46f3-ad69-5dcfdc00830d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d297d671-5c67-440b-a8aa-7a747ac8bbd4", "sighting_of_ref": "indicator--2581a85a-da36-421d-a87a-8b1d2175800f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3758464-78d1-4fd7-a426-8ef8921e96c0", "sighting_of_ref": "indicator--4e6ff261-931d-403b-b0b9-ef7f3fd7ebef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ee1d62e-187e-4a0c-ab3b-a14f9e475291", "sighting_of_ref": "indicator--745368a4-d0a0-415d-b797-0c0595800f1d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f859d97-5c66-4b65-844f-aab26611ae2f", "sighting_of_ref": "indicator--10f8862e-d544-48bc-b278-2509c8d446f8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1c19108-36e9-4985-8744-24d3f4a8df71", "sighting_of_ref": "indicator--7b8a325f-4a70-4412-ab97-e5c9fd1177fc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c225d8fe-5cd9-4cf7-9a73-9eede635ce9d", "sighting_of_ref": "indicator--29308b02-e361-4968-962b-f0c5e1e0584b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ad17876-1b76-4588-9c0f-1b2e8649c709", "sighting_of_ref": "indicator--d6d4a14c-9870-4805-9df8-2680211dabc9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c8d9114-1680-45c4-a157-c3f253ec5a4f", "sighting_of_ref": "indicator--b122875a-e332-4154-8f63-8238b298c492", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb30784-35eb-4652-9520-502455c6190e", "sighting_of_ref": "indicator--ee49b489-29c4-4d93-94ab-fef3e609c6db", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db4b332-8ac1-4483-be66-07c1d8ab9d72", "sighting_of_ref": "indicator--4ab01dc0-2c15-4de1-a952-7d981ad76654", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b400e2-1fbc-4c09-868d-52e5ff5766f8", "sighting_of_ref": "indicator--e96ebdd1-7165-429d-861c-271a32ab0e32", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a4aae1-e2b2-48f7-a6ec-361511ecf5db", "sighting_of_ref": "indicator--b45e6409-dae8-408c-b141-83f56d961755", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--897a9763-0a91-4d37-a308-cb2e908ca034", "sighting_of_ref": "indicator--b2ceb35c-f1e6-49c2-ba90-310daa47470c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4edcf8ca-2f16-485c-a9e3-805d8f329a2e", "sighting_of_ref": "indicator--768dc7c5-f26a-403b-85a6-ec60d576638f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dde50264-d933-41cc-8f0e-10ed7d35bb3f", "sighting_of_ref": "indicator--d560c83c-cd2e-4da7-b61d-61a05e9feb21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2472b9d6-d097-4038-8b3c-36a26a243069", "sighting_of_ref": "indicator--9fcef847-9865-4b93-aa84-7e90fdf659ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61c2f8dc-1a48-47a6-b6c4-b6df715d090f", "sighting_of_ref": "indicator--230b49a7-ca55-4d3c-a2b4-dcc5e4d054d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cacfdfe0-d973-4c63-9613-cfa4020bbafc", "sighting_of_ref": "indicator--0d9f9bc9-b623-49bb-89f1-2256c591d4f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72aa93ad-8ff4-40ed-8b58-2d4c9a68b5be", "sighting_of_ref": "indicator--a9ed53e9-1dcf-4280-a901-5c359d3806ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db0bca4c-48ea-4e41-a5f6-d18a59a65244", "sighting_of_ref": "indicator--ba06f7ac-4b91-4169-8fdd-01d6ecf8daaf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa408c5c-ab55-4d86-a2b7-72ea021725c1", "sighting_of_ref": "indicator--cb930753-08b4-4658-a492-bdcedf4fc375", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e9b056-a5f0-47b9-bb33-ec1586f504f2", "sighting_of_ref": "indicator--f6022046-6816-4815-a33a-f26fd5cca1a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d15ac219-27fb-46d1-a89e-eae0f97b7aa4", "sighting_of_ref": "indicator--412601ca-e3d7-4740-aab7-1edcafd83937", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c7647ae-1398-41b4-9f08-68a3dbb40b2e", "sighting_of_ref": "indicator--7686c978-a0a1-4d2e-bbc0-853d7c4a5455", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b9d58b9-3c2e-4810-b64b-3c18fba0c9af", "sighting_of_ref": "indicator--f46c7506-1295-4677-90ed-73b120c3651d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f30b16be-0338-4845-ad0e-0787ce660f9c", "sighting_of_ref": "indicator--050ef3b8-83ff-4932-9434-296aa95f34b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fde1fd9-ce5f-45cc-848d-58d894ca7caf", "sighting_of_ref": "indicator--03163b1e-2c9d-4839-adbf-17180f343899", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbb3c477-aace-4663-b0e0-cd423bdbeabf", "sighting_of_ref": "indicator--a35c2dcc-3824-437d-943a-9ea71ed5d7f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--011e85ea-b5ff-480d-9593-ea6015cdcdf1", "sighting_of_ref": "indicator--381f8776-10d1-4c34-ae18-241d7b51a817", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8882cb22-f8af-4260-83a2-f2998a04c478", "sighting_of_ref": "indicator--617b4f1e-13c7-463b-b794-6282dda0ba25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad67d1e0-ee19-4689-9dbc-ddb495f9bfb5", "sighting_of_ref": "indicator--1a7e0904-6489-40b4-9602-3be8ef7e7155", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e96ddb-92fe-4701-a1c9-1e71d3d73b5c", "sighting_of_ref": "indicator--989f9d55-5c83-43fc-a9f8-e008aa30d6b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b1cac02-e0d6-44e8-b23a-c9570538dcc1", "sighting_of_ref": "indicator--c922f159-145d-4f7e-b75d-fb0983b7ac60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74a3898c-e7f0-4b8e-b23d-fbff131516fb", "sighting_of_ref": "indicator--2f15d973-47c6-4c13-a14c-882febb41a88", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a0d2c9-f805-4f31-b4f6-e3fbde31e0cd", "sighting_of_ref": "indicator--a02dfcb1-2bba-483a-8d14-b24543fa5a4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343f332a-9597-4eb9-a7bc-23df44dbbbe7", "sighting_of_ref": "indicator--8c290919-fa98-422b-865a-bb493bfc01e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c532e50-68da-4d7b-b128-beb75c77945c", "sighting_of_ref": "indicator--3768731a-d92d-4f36-80b8-d0f6090492ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c038e5b-b4dc-405e-a5bf-44ff1875de80", "sighting_of_ref": "indicator--24328671-1d5e-4178-8a36-8cde4461c3b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a872ff94-f1b5-4c54-9fdb-dcc4ed3f5598", "sighting_of_ref": "indicator--0b13c559-8f49-4bc4-a5d9-37a713e296fa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4fdf214-d604-4035-bd1e-536d76b8ddb2", "sighting_of_ref": "indicator--1a02038b-fdaa-46d1-8102-7642bae89174", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4219f5ac-8307-4950-bf94-203ee42b4794", "sighting_of_ref": "indicator--c622888d-8c85-4523-b1d6-8edb3a24ab65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82d94828-daad-44de-8aba-0da2c0fa957b", "sighting_of_ref": "indicator--0b65106c-6225-4c9c-8b7b-0c516f6dfe25", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06ab8ebc-434a-49db-95c6-f5c57f9c3092", "sighting_of_ref": "indicator--6f542b1e-bdec-4255-bb73-a64adfd303f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c5e8dca-6738-46a5-8950-740460720391", "sighting_of_ref": "indicator--cd720be5-bff5-486d-8f3e-bbc1aba9bf87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12a22093-dc61-4eb6-bdd1-6a4e0d884054", "sighting_of_ref": "indicator--b837a2c4-b25b-42e4-9776-76e48305b634", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f268ffc-2070-4ab3-9e58-23cd7202c7af", "sighting_of_ref": "indicator--dbe22428-fc8a-417c-b352-c58f51bbdc9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d29424f-14fc-4437-b147-08ad3adce3b9", "sighting_of_ref": "indicator--eed92078-aaa3-4bb8-ba59-c8a21d336b8b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68bffbc4-e290-40b3-83ff-0500a0f1ce19", "sighting_of_ref": "indicator--fa0d581a-20f7-46e6-a5e2-da23733d3e56", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37ca5b69-e0ab-421c-94ec-a440ecc0297b", "sighting_of_ref": "indicator--a4dbed2c-a3c5-45f8-9e25-d64e9f5a146c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0efa6860-dd9e-4813-a335-b19c97c6cd08", "sighting_of_ref": "indicator--64b11a9c-7bfd-4218-bc84-889267af9791", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29010f5b-1c15-4f8a-8910-74dc34e5381c", "sighting_of_ref": "indicator--c1219165-c161-4266-9cd6-e30b8fb40868", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab6aaea5-6749-4ec6-8c0a-00cab1742709", "sighting_of_ref": "indicator--238b11ec-ec55-41be-afa8-f5eaef1cf6b4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5054bb2-c32c-4b50-b86f-b967b6339bfc", "sighting_of_ref": "indicator--b612858e-dfe8-45ed-88d5-703c9dd0f0f5", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc9837a-b65c-480a-be73-8997c01273ca", "sighting_of_ref": "indicator--66e5d4a8-c3e5-4634-b28a-d624061f3708", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54cc046b-3ec2-4b6a-8fa8-b7f97756fd84", "sighting_of_ref": "indicator--f6c2bf63-15a4-43e2-bbfd-6a714abf6211", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a9475b2-2da0-4ae0-9cab-cc3ded47c741", "sighting_of_ref": "indicator--e073627f-a8dd-4758-a642-e19ddaa07be3", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6205d2e5-248b-4470-90c1-7a0b33b78e93", "sighting_of_ref": "indicator--91205b3c-8a6c-4e74-aaa8-7eeec34fc9f6", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d1e4535-a21e-4b65-8dfa-4e1c9e069577", "sighting_of_ref": "indicator--76eb525f-a956-4a69-9205-bba1d7a29a24", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e8fafc2-7e74-4618-8b09-4797b69c32fc", "sighting_of_ref": "indicator--ad3808e3-dab6-4b98-9190-0ae5fef5da92", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2610783b-fd6d-4cbd-8344-11be09251a1c", "sighting_of_ref": "indicator--a51b5dfb-f0ed-405f-82e7-b1ca9797ccd4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--127cd368-cc09-4587-94e4-3e4dc38f241d", "sighting_of_ref": "indicator--b8d4cbe7-e853-4865-9c85-10ae3cd2b63b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2add062-9f1b-4b3d-9c15-6134426d0541", "sighting_of_ref": "indicator--72d37a6d-cbe7-4a85-8f19-a4636c368e2a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e10032-4bc4-4197-a553-83df7796d716", "sighting_of_ref": "indicator--3282b9c1-5933-44bd-b07f-f75f272ea940", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d351036a-d442-4d82-9f9d-26cff2069671", "sighting_of_ref": "indicator--0855172a-3736-477d-8296-358a051621c8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90167bd4-49da-4a97-a6a7-658bdeedaf83", "sighting_of_ref": "indicator--b3c792ea-8d66-493a-9871-08a5e509db50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d29ccdb8-6530-48bc-b956-47be617e180f", "sighting_of_ref": "indicator--f1a1b554-dbd0-4efc-8d80-5e5a502035e2", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08fceb1e-7a7d-4675-bebf-feccfbbc93d8", "sighting_of_ref": "indicator--1b089b29-ca8a-4561-8dbe-1bfd77eee9e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b978ac1-140a-493b-b5b2-9972578609b4", "sighting_of_ref": "indicator--7460e9db-836d-427b-9ef0-3252a83ba5cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f8f3b3-d2f4-45e1-b85d-010bdc80e528", "sighting_of_ref": "indicator--7acc34c8-dc99-4af7-aef0-b88293799707", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fc8ee41-3319-413e-b014-3a5deb5383a0", "sighting_of_ref": "indicator--6c2c92fc-521c-4c31-a3a5-8c44cdb5005d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bdac1d3-686d-4ae4-a9c5-c932ed5af92d", "sighting_of_ref": "indicator--6151fc4e-d704-4c90-908a-9468494ae352", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc6d50d8-10e6-44e3-952c-daa3b13089cb", "sighting_of_ref": "indicator--dd059798-3a79-49b4-9657-8b6bb19f7b01", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc43a291-0719-494a-80d0-480fd1ffb2f6", "sighting_of_ref": "indicator--7ddb143f-632b-4452-9b31-4664d522d1a5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60da387d-56c0-42ef-84e2-d96c0ef33ab3", "sighting_of_ref": "indicator--074bb10c-bf01-499e-b364-754c0bb4ddb1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31c4f80a-eb18-4835-873b-148f024261a5", "sighting_of_ref": "indicator--1f284610-06ae-4e0d-bf67-b1de996b1a6a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc52029a-1a93-4352-b79f-f048ef20e6e9", "sighting_of_ref": "indicator--6a957c2b-ea64-45a4-84b8-8327cd8e73b5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f8b806-eac0-42d7-8d37-8bf905fdfd6c", "sighting_of_ref": "indicator--e2d34fd2-edcb-484f-afeb-0aeec67c2385", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f58cf2b9-75f2-4edc-a003-6e530621aeb8", "sighting_of_ref": "indicator--b03784d3-8287-4d02-9605-d28b6802493a", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad3382f2-ef3e-4e3a-a451-e9324adcfb86", "sighting_of_ref": "indicator--e25c95fe-5faf-455d-a681-31bc178b51fd", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8257d23f-688e-43c7-a6aa-320e558763c6", "sighting_of_ref": "indicator--b5cf601e-964d-444e-8bba-d526fdf2b7ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--428bacf7-9c43-4fc3-86bb-cbd9b6a149b2", "sighting_of_ref": "indicator--fde38758-4e13-4a23-976d-1cac48d424bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd00ad41-53f4-4cfe-991c-6872afb1a2f2", "sighting_of_ref": "indicator--67e92444-ab64-47dc-adab-9319c7b96b2b", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8240060c-0c2f-4c99-8705-88a21b34b846", "sighting_of_ref": "indicator--9c7bc569-44af-43cc-a6fb-c55973b0acb8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b67c0b2c-bb04-4e66-8540-19c2e11f6bf5", "sighting_of_ref": "indicator--90172170-000c-4f43-a2c3-b4d439919ebd", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1e218d4-85f9-44c2-a4d8-999af5639b28", "sighting_of_ref": "indicator--ed1fc9ff-8e1a-424a-b62f-04214d04c1e0", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0bcf17e-f971-42a6-ad04-fed892be9c9b", "sighting_of_ref": "indicator--32185a9e-49f8-4eb4-a124-60a1bf99f243", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0baa2847-0294-4e82-bdb0-471e7caecfd1", "sighting_of_ref": "indicator--5b02e4c9-9256-415b-9ccf-cfdd2c5f4264", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f8658a5-216e-47be-bb8c-f27a0b0bd06a", "sighting_of_ref": "indicator--79b81c81-3887-4343-af3f-b65fe067fd5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc5bf972-ee18-4001-b9d3-c7784fc3f5df", "sighting_of_ref": "indicator--5405af2c-b998-4c43-ab90-aee656739635", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6284f33d-2eb3-4eb7-8b50-6352670175da", "sighting_of_ref": "indicator--1411e2f8-8a0f-437a-be4c-f7126e39edae", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--553a0552-378d-4a08-a2f7-207eaa12ee63", "sighting_of_ref": "indicator--66f19378-4835-4131-a909-21cecd7dd31c", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb59c154-a5de-4592-9cbf-af59c09c3d36", "sighting_of_ref": "indicator--d1e0586b-5222-4eee-acb8-af4fc6522975", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce4f59c2-8f30-422f-8db7-78ec825f8244", "sighting_of_ref": "indicator--d1e0586b-5222-4eee-acb8-af4fc6522975", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--054a5bbd-b8a4-46c2-9974-54421a9fac17", "sighting_of_ref": "indicator--8817015e-164a-4f7a-9a1e-98241281513c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed3dc35b-6bf1-4cfc-a184-f2cc93745768", "sighting_of_ref": "indicator--88ede854-ce80-4162-a9e6-7e4c72dccceb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--179887f2-c4fe-4d7e-a2b5-240944372f95", "sighting_of_ref": "indicator--3baedc44-721e-4e01-b00e-411b43691405", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb0599a-2eff-48d9-ba0b-f7a9cf48c3bb", "sighting_of_ref": "indicator--bff9b5eb-2678-4f25-814a-cba58a7a5e8c", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5edcef-12b2-4a45-963b-6aa0fa931876", "sighting_of_ref": "indicator--3b417085-4247-47ac-a370-5d4988606ec9", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aadf5cd3-b165-4c9b-bf57-22ea89c12a42", "sighting_of_ref": "indicator--fb1e0ea0-c594-4e23-bf29-f8d3db3bff8e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--938250ea-bf2d-4395-a523-905b60ecde33", "sighting_of_ref": "indicator--97cde0c3-3774-4486-b235-137fc8587b63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77f8df10-5b22-4e43-be85-da677b48508d", "sighting_of_ref": "indicator--02be87eb-4fc3-4af6-bb6c-22290489a6f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4ecbc2-7b5a-4e42-883b-49134e86849e", "sighting_of_ref": "indicator--3a817664-f4a5-41fb-8eec-ec8a2795f995", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--123276fd-d700-4376-9d2c-7e6fd430b69b", "sighting_of_ref": "indicator--36145130-500d-494f-8fdd-50978e422d4b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13b890fe-7e73-4900-8f92-42b95a08959c", "sighting_of_ref": "indicator--f57526de-177b-4e76-baeb-3e4b07467523", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c55b4e3-4160-454c-b993-5e2b819a7d44", "sighting_of_ref": "indicator--cb1f80f4-2b5f-4372-862e-71533b597ba5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--262f4b68-b02e-4961-acd6-355471f620eb", "sighting_of_ref": "indicator--3f7ddcdd-2444-4420-803a-5a2553446f48", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a3547a0-437c-4d34-95b6-358a6f19d746", "sighting_of_ref": "indicator--5b46c3fa-0c77-44a2-97df-3a6a0be1ed44", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e49c69-8b7e-4600-a9c0-d83a8799546d", "sighting_of_ref": "indicator--7b877a84-a9f6-47fa-ac04-50be0915d867", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd981c8f-2091-42c6-b0ce-06b5a95e8657", "sighting_of_ref": "indicator--f40831bc-6f33-4df9-94b4-f566b3a9fa86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7eb48763-c3e6-40bf-b41c-43166336e3d4", "sighting_of_ref": "indicator--dd1b75f4-b9e1-44f4-a4b7-8fd209ea0ab6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb7d5595-5638-42c3-b17a-0bffc7661e02", "sighting_of_ref": "indicator--2f44e7c6-6e58-4792-b617-7c5e5ea48531", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b7a44ba-f102-40a6-b468-190a57dda0a7", "sighting_of_ref": "indicator--8db5d369-55df-4d5b-8c7c-0f205e29fda5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68b4f76-9628-40e0-83e8-1ec7051cf50b", "sighting_of_ref": "indicator--cb807d52-3469-4df7-a2b3-7314b530906c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10f60ec1-cfa4-4a7a-911f-9b5367739451", "sighting_of_ref": "indicator--81b680ee-183e-419a-9411-c2ad5445a7e5", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03eeef7e-fe2c-4fbb-831b-46ee7758d957", "sighting_of_ref": "indicator--23bc2e0f-fe3a-4d4b-bb94-27fc9739412e", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f23c7f9-8bd4-4ba0-b4b6-ccebf738a0c3", "sighting_of_ref": "indicator--3a9727f3-44e1-468a-907d-8158a93364aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e60d6ecd-53a3-4839-906c-02da741e7082", "sighting_of_ref": "indicator--8a8ffea4-8712-4140-a050-9be56b5ed873", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8969511e-ce3d-4896-a505-84c603f1319b", "sighting_of_ref": "indicator--ec56840e-5c89-4673-a7f5-eaa0d98a6d49", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918c1088-68fe-493f-bddc-d0520eedd7fd", "sighting_of_ref": "indicator--d97f02b1-ff24-4039-bda9-0579d6c37a71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a852dd2-a7d2-40ec-80f0-1213849115a6", "sighting_of_ref": "indicator--432da589-effc-4982-b476-cb0f898330b2", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10b56fb8-b65d-4822-aacf-6b42c39228a1", "sighting_of_ref": "indicator--fca1531e-afc9-4c4f-9a91-410a4f0234cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56a573c1-c489-416e-b8a8-143be93e373d", "sighting_of_ref": "indicator--104541e1-e367-4159-b9de-fc810f7ab2e6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ede20df-968c-4432-8149-5ba51008ec21", "sighting_of_ref": "indicator--b4a130da-7e3d-4421-a60b-dc84f8098bc2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1833b8eb-6460-4e13-a8fd-0ee2f1d87ade", "sighting_of_ref": "indicator--ecd4fb01-732d-4b0b-b7c9-be630209c5ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52cc64db-b79c-4c8d-81d0-acbd2a636d18", "sighting_of_ref": "indicator--ecd4fb01-732d-4b0b-b7c9-be630209c5ab", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d560cbf-925d-468d-9612-de067ce1522e", "sighting_of_ref": "indicator--09f06cc2-0887-4f0a-b1c9-6ee99d5da232", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1713dd1-6756-45df-8c23-f18c29811a8d", "sighting_of_ref": "indicator--3acb8be2-d255-4c0e-a95a-5ffd3e68af27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--053c6929-b0d3-4db5-bec3-8ff01bc6ba7d", "sighting_of_ref": "indicator--bb355bfa-e6a7-4bb7-849e-2441b07d12f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11386e5e-fb8a-4a48-9f39-7b93337b07fe", "sighting_of_ref": "indicator--7a939874-c1f2-4bfd-b249-7f6df07a9640", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a57ee27-b26b-4002-8465-2e10e94c7142", "sighting_of_ref": "indicator--9c3708ef-e336-4b0a-98c6-c18a0ea5e5ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--971b9a0c-1138-4b62-9126-64d6cce4a280", "sighting_of_ref": "indicator--4b3007d2-1ad4-4309-b1d0-aefb94da1865", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf24dbe6-80f3-4970-a2be-727534557f90", "sighting_of_ref": "indicator--ca9e7a38-89a6-455a-9824-321fd2272354", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e3387d0-f185-4e3e-93c4-c2239833f3a2", "sighting_of_ref": "indicator--f1e4c3be-674b-45e6-a9f3-39df8982e822", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d57793c-708f-42dd-84a1-62dab6260ddb", "sighting_of_ref": "indicator--5cde4680-15c8-45b5-a83d-c0e6adf75300", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efaefbee-9a5e-4968-a9b5-4c607a022cad", "sighting_of_ref": "indicator--7a14e5c1-e5a2-404c-a767-04dc686f2253", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c23949a0-bf10-47b0-a3f5-e01cde5a8c61", "sighting_of_ref": "indicator--48b22279-6c0b-4491-af97-d6d0a2d8fb5f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5ca0c7-91e6-4798-a788-5b3274ff1dfd", "sighting_of_ref": "indicator--98548f14-5f42-4b1b-a9e8-994888088ddc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf14ff7-fe34-4925-bb9c-96f77fc4c7f9", "sighting_of_ref": "indicator--a006d4a7-df7d-4990-9186-09b6202e5c8f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa2ed51e-384f-4503-a90c-e6f67814548b", "sighting_of_ref": "indicator--eb12a571-1373-4cd1-bd59-7697a3b120b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9c90e69-3bec-4ece-b6b7-222dfc64967a", "sighting_of_ref": "indicator--3f7131d3-a682-4fdc-b51f-18909e7cb507", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7694b40-c9f8-44d4-9b80-ac4721804908", "sighting_of_ref": "indicator--a16b29af-9330-4ec8-91c0-73fa541501a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25f03410-3c95-43cd-8ad3-751864e5d009", "sighting_of_ref": "indicator--8b50d3c9-96c3-4780-b4fd-abe93dddca03", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0aa8952a-6d6c-42cd-b3c6-33cf62c8e7d3", "sighting_of_ref": "indicator--fc5bf8f5-cf28-4175-8079-cabc4807a8e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7547c09b-7742-4d9b-b99c-e5a15a27393d", "sighting_of_ref": "indicator--7e889c0f-e1b0-4529-adab-33eae400c02e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--624f3d06-3ceb-404d-84e1-f9ea3300c641", "sighting_of_ref": "indicator--7677c8f5-75d0-4d62-a72e-ad450941c025", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eaccf64-0d0a-4b12-9b1a-29cd66b080a8", "sighting_of_ref": "indicator--381a4e02-c4be-43e6-b84a-e574f1cdf0ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1f3aaf3-d5b6-445c-a8de-0861ab63c0f5", "sighting_of_ref": "indicator--79c3a138-5e42-4b01-8180-c5db3a8f8216", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad32ada5-07bb-48e8-a6c1-516a348a4a5d", "sighting_of_ref": "indicator--1029e322-6d5e-4068-b1db-f1cc01975e93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e94a1b8-0575-4d84-9dc8-d356c60f47ca", "sighting_of_ref": "indicator--bf675748-d62e-408c-a887-3644a75c25b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--708f3b4d-ebfc-49f8-87c9-beaac16ee8b3", "sighting_of_ref": "indicator--88a61d69-feb3-4342-82e7-3d86c698d778", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2749ebac-78a1-4c05-ba24-6c11f32a320e", "sighting_of_ref": "indicator--6cd6ec67-c1e8-4f40-8f22-8dd13f47c79f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87b7542e-d515-47ad-821d-9a9f377f7605", "sighting_of_ref": "indicator--4206dee9-8ce5-48c1-a706-c2ae0996c07f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9419bc60-5612-46d1-a8e5-53299599f2b0", "sighting_of_ref": "indicator--a561752d-f6b9-48fb-8021-48ffb8f4a016", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8809f34-0480-4b34-bb90-76eafe38d373", "sighting_of_ref": "indicator--d421677f-c0b4-4cf2-9eb8-9cb48f081b38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da2ed750-4525-4649-97b9-919d236e4b48", "sighting_of_ref": "indicator--b1d35bb1-f42c-4631-9695-456e4617c2b3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fee6c280-be78-40e9-aad8-708ed7b5b3af", "sighting_of_ref": "indicator--f3515843-ff6b-4061-818a-0c2274e98596", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--65d76e00-2c9b-4423-9d1f-6bc0e2cf6efa", "sighting_of_ref": "indicator--667e0250-8f94-4d45-bf2d-b9054d2ee65a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8e037c5-9150-4931-a608-22b6a6e524f0", "sighting_of_ref": "indicator--f6821926-e671-49b4-bc5f-9905dfdd4493", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79438da2-2da2-431d-a97d-1f99fa78ee96", "sighting_of_ref": "indicator--dfc2ffe2-0108-4d0b-8daa-4503fac3046a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17db9dea-f82d-4b13-a15c-bcad61e12d19", "sighting_of_ref": "indicator--27ec2445-fbff-4c3d-85fb-226d64e80afb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b110ba4-471d-480e-90a9-e8de07a7f67e", "sighting_of_ref": "indicator--cec56a26-ff8f-4721-8885-a921e7b60467", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c8b507-754e-47bc-a6ea-3c5f9faff226", "sighting_of_ref": "indicator--680e9a1c-86b3-4f1e-8396-abb40daeb587", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fa38f19-e900-4906-a913-1c5628eca57d", "sighting_of_ref": "indicator--6c993762-0c1a-471a-b1ce-7960e2320bc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ba05731-196c-456a-9d83-fc506e8259cc", "sighting_of_ref": "indicator--ec90818f-65c6-4b32-9ef7-aed6009a7e2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a3e8b1a-4ec2-4f3b-aa81-817955c38eae", "sighting_of_ref": "indicator--e4c09622-0993-43ef-bf10-a6e43736adef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95717509-b261-4607-8895-2aa129b11609", "sighting_of_ref": "indicator--24c74dfc-9855-4b34-8f1c-d19eda3d3f7d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c34a282a-578c-49d2-b344-800eca3635ac", "sighting_of_ref": "indicator--11e41fdc-a82c-4ad8-a1ff-475aab0660f3", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--651cf9ef-1850-4feb-bf3e-960420902688", "sighting_of_ref": "indicator--3ad0bb50-a542-4fef-8af8-e8e63c7e9a84", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a307bb3b-9537-486a-ad4d-6067b42850c7", "sighting_of_ref": "indicator--3ad0bb50-a542-4fef-8af8-e8e63c7e9a84", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3dbe358-dec4-4669-9e65-8f09b7496ebd", "sighting_of_ref": "indicator--10c208ee-7645-47e6-852f-6f7bca46de33", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62bc169d-c8e4-4ad7-9dfb-4cf30c42e076", "sighting_of_ref": "indicator--1637c074-7869-4db3-b3bf-4a406ef9ed1d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d3ab2a-a075-40b0-a388-9225196485cc", "sighting_of_ref": "indicator--6b7ac8f4-949c-4b60-ab59-acae11c72ce9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a325ceb-4cde-4a82-8d68-c4454e221ec8", "sighting_of_ref": "indicator--70aec19d-143b-4a63-a84d-b0448db64b19", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92267014-6da8-4410-97d5-2f40b1160d43", "sighting_of_ref": "indicator--45fa98b2-d998-4074-b021-4e29884a9fde", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50a48829-2421-4032-9ab4-6711372c517f", "sighting_of_ref": "indicator--f9f84753-29b6-41bd-be6c-6d6ebab78507", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e82d61f0-bc6a-45ee-b859-9798bbbd1fd5", "sighting_of_ref": "indicator--9c8775d1-436b-4ba1-b747-740f8fcca1d7", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f1ca203-f473-4814-86f3-79041026a8b7", "sighting_of_ref": "indicator--87fe0552-d5ae-44eb-9c11-61fcaa0404bd", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0cd8e5a1-591d-43b2-9439-5f874b48ea73", "sighting_of_ref": "indicator--10acc819-c6a0-4d57-8473-18bbb9ca980d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee8a8a65-0088-41a3-b162-d2f89db63d33", "sighting_of_ref": "indicator--ca462439-4358-43a2-acab-2834c3c0a32e", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d02bc99d-8c2b-4722-b37e-cb90db076fc3", "sighting_of_ref": "indicator--79779657-e893-4c29-adc7-2b28f6e144a8", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2172b69-a45a-4c9e-873f-c31364273533", "sighting_of_ref": "indicator--1748a7a1-a0da-4467-9ffc-c09986e1e5ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8057072-4b60-4b63-a56a-534e8010a6cb", "sighting_of_ref": "indicator--e9ac1c13-4678-4a0a-aa49-69ec4a44f359", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddef034e-eeac-4b23-a997-a95a81ea1bee", "sighting_of_ref": "indicator--ce23e932-d72a-4c40-8d46-b48c5e78f293", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aff24fd5-b023-49b3-bc51-202de7c7d982", "sighting_of_ref": "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d341138-7c16-4eca-a4dc-e91ea307c432", "sighting_of_ref": "indicator--fd2411ae-9feb-4fb0-9397-2c55f8c15afa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b17d028-ddcc-4ad8-9ff4-6ee95878ac69", "sighting_of_ref": "indicator--eb32be5e-c428-4737-b5ec-055191ea314b", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--248c2d1b-95d8-4093-8189-e7ff74d86593", "sighting_of_ref": "indicator--e9a76d64-0396-451f-bd75-2f710b8d9f56", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8acc8891-da95-416e-a055-05ec3461dd16", "sighting_of_ref": "indicator--f9443690-a6a4-49cd-ba98-f7531ccbb60f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--910499d0-88be-434c-bc7d-ca182bfe9c3c", "sighting_of_ref": "indicator--101ebc72-31d3-4526-9c66-2db03cbc2b3f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0f4caa7-fb73-4d3b-8ec8-87ae679624cd", "sighting_of_ref": "indicator--b09b80a9-e0d8-46b0-9e15-e342e86ec751", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a22bd5b-633d-4e95-bb9b-e369414fa9bb", "sighting_of_ref": "indicator--d3d6c783-45ea-4ab5-84e1-c28bc6785789", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d873b88e-3b9b-469a-8bc9-612afc82a655", "sighting_of_ref": "indicator--73695f1e-60f4-4c53-9fb8-6d5551cf101d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95c0d5d5-e5d0-4af6-b3c4-25e64fa72d18", "sighting_of_ref": "indicator--666d103e-927b-4c6b-88c3-06a161e3238f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c767ac00-fed7-4d8e-8983-2208f8619b66", "sighting_of_ref": "indicator--88221bb2-e58c-485e-8055-506eec8af874", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6eddeff6-3d4d-47b3-9a34-c4f95c517158", "sighting_of_ref": "indicator--8876b46d-1f9c-44ba-8f37-ea2317fadcf9", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--612275fd-3b00-466f-9196-29fdc2941060", "sighting_of_ref": "indicator--7aed01c7-75bf-4b9b-b9db-785d71c1e926", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b16d580-e6c4-4366-adcb-a62319976dbc", "sighting_of_ref": "indicator--5dfbb1ca-b8d5-4aa7-94c3-4fa1511e8340", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6382479b-fc4c-4ca3-90b9-f87706c0c242", "sighting_of_ref": "indicator--e2589c8a-f8f4-4572-8a0d-4875e9507ca7", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4266af9a-fd69-4aae-a5ac-9c4d2cd5c84f", "sighting_of_ref": "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec2bb63-68c1-4f2a-92fe-2c7e506d1353", "sighting_of_ref": "indicator--230ee2db-60e7-448c-95a4-221d7744d341", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a6124d8-982a-4ee1-9846-381f827b5857", "sighting_of_ref": "indicator--dea6b652-982a-477e-861a-994067ddee66", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8956019-db41-4a92-9008-0d2e590edd04", "sighting_of_ref": "indicator--30674f96-16c5-4048-9625-ae229cd8b868", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32ebce8b-2a51-4dac-9be8-73300f184467", "sighting_of_ref": "indicator--af89719f-8880-4178-aa85-10ad42ba64e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96b2d042-600c-47b7-8b4d-30a67393d130", "sighting_of_ref": "indicator--d4389969-cd12-449b-bd7f-813f11972c6f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffc24263-0e34-4ee4-a0f3-2c767a862387", "sighting_of_ref": "indicator--8e123692-a7a1-4cee-9b50-936b132b4fc6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bf7bcc2-a3a8-4626-89cf-361330b4ac19", "sighting_of_ref": "indicator--d1a475f9-78e1-4736-b7bb-3190af9332cc", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bd7a4dd-0510-4f91-8282-223186794ef8", "sighting_of_ref": "indicator--ce0a09f5-5851-436a-a190-f0628d22465f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7603cd9-4aa6-48c2-a771-3d84c847a43c", "sighting_of_ref": "indicator--c0020f72-d154-4753-b63e-96e8f82c879d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bc3827a-a92a-449a-8673-2e7fe810e086", "sighting_of_ref": "indicator--15d1343b-cb96-4e7a-9b32-1da46721bfae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ea22f23-6df7-404a-83e4-59bf8d912f27", "sighting_of_ref": "indicator--b50757ed-4296-4627-aad4-d2208fb43366", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeea0ffd-d774-480b-9c11-c7c08371c34a", "sighting_of_ref": "indicator--4e81cca8-0b42-46cc-b7ad-62dada502aaa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48e6a307-fb84-432a-8a2f-f7d7c31b1fc8", "sighting_of_ref": "indicator--0bd74719-21b6-4c15-8219-aa46733c949e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6373166-6ede-4805-a769-2bf9be11ca91", "sighting_of_ref": "indicator--8ec0a69a-b01a-4be4-93ed-2bccf6f36f60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ee7b9a-cc0a-4420-9219-9df29ea4b278", "sighting_of_ref": "indicator--67f485e8-68ef-4400-ba96-4b3e3f7b286a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--189a0415-9f5e-46a3-a676-33ef3fe2a6ae", "sighting_of_ref": "indicator--d7d57430-1ff2-4552-9a4b-aaee20a38a50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea4b0fcd-788e-4316-a747-1ede9b7ee80c", "sighting_of_ref": "indicator--7932e44f-97c9-4a0d-9c3a-98b5a3d7ffde", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc8bbccd-5633-4771-a76a-af3d0ee3c493", "sighting_of_ref": "indicator--d9555c45-0dcc-4eef-9842-d7d9c75551cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc78ad67-06b8-48c1-af23-e37c27b6a7e9", "sighting_of_ref": "indicator--77c825cf-9148-4706-adac-9f1e24f01307", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b625cda6-591e-4089-821c-455343b42dab", "sighting_of_ref": "indicator--29b0205d-52bd-4c11-8c5b-7f73c69af994", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e149453e-6c98-46a5-b974-e4807627f4ba", "sighting_of_ref": "indicator--5127616d-5815-4c7a-86d0-25c4fefc2a34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b201dde-cb06-423f-ae7e-9bc85d42ca4d", "sighting_of_ref": "indicator--34988394-700f-4d1e-8927-8aa1291ce967", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6e3329a-27f2-4274-b482-5edfe64fee23", "sighting_of_ref": "indicator--2a87553b-2f7a-4957-90e4-b61861e6ca13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7266d4-a280-41d7-8377-7ffbc296b35c", "sighting_of_ref": "indicator--2a640851-6255-4390-b142-78e12fc0a495", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b20af8f0-bce5-498a-b6c7-80ddce12150c", "sighting_of_ref": "indicator--143661e4-eda6-470a-a57b-545f19e084ce", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f02cde8d-5dd2-47eb-a8ba-b4a4ae90bd31", "sighting_of_ref": "indicator--e093f31e-80f4-43fd-a1ca-a594c1e255a8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd201acc-d80d-467b-8782-ed2f689ef0c8", "sighting_of_ref": "indicator--d7a1f460-d5db-45aa-bba1-c99eb599002b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fdf3e87-f792-45fc-8027-2fa96f7a49b1", "sighting_of_ref": "indicator--5fd646f6-387e-42ff-b4f5-6c0e27c75882", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b59a8b9-eef9-44f4-b4f8-2cacc908aa87", "sighting_of_ref": "indicator--2ba46a5c-a346-4b48-8ab1-e78311039ede", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c4e9e7-d24d-4c45-bb4b-1897bdfd95c1", "sighting_of_ref": "indicator--58e585e7-b422-4565-acfb-5e2c6ca0be2f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--599b905e-d1b9-4eac-9c4b-184314b812d5", "sighting_of_ref": "indicator--54e62909-463c-40aa-bf0a-cc175d4c2f3a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a000576-90be-41a1-b63b-ffcb31cef2e0", "sighting_of_ref": "indicator--f87157e1-224b-475d-8379-a577c8f4e7e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb0d6b6f-c9ef-48ef-9b3c-4095c043e190", "sighting_of_ref": "indicator--bddb2154-aae5-4fe9-89d6-4ffadb4d8d20", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ebf1a8d-395b-41ff-b783-f4173e1e7c16", "sighting_of_ref": "indicator--d46ac6cd-10ea-4392-af58-5c3978c71164", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb293e2a-a903-405c-9ffc-dba2464b1f57", "sighting_of_ref": "indicator--f6b91ea4-2a5d-4fea-96a8-2b75eaab4bec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc213375-ebed-4bb2-b317-d5dba42a3201", "sighting_of_ref": "indicator--58b2b3f8-960f-44fb-b617-ca56e03e8009", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3588ae82-4e1a-47b0-a7e4-4edc8f9a3075", "sighting_of_ref": "indicator--445d7ce5-7734-4574-963a-7488ad85ce15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1922294f-c672-4dcd-a796-41c40b9d4162", "sighting_of_ref": "indicator--4f7d836f-51db-465f-b5c9-ea52c322882b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf41bf4c-04ec-4bce-bc26-9b7f5cb3d232", "sighting_of_ref": "indicator--2afff615-3af0-491f-b75b-e85603caa4e9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091c327a-bc1c-4021-86aa-b2e54665b150", "sighting_of_ref": "indicator--37ce18d5-696c-4460-b007-56898de00346", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eda476d-9c5e-4667-beb1-f4779d104c6c", "sighting_of_ref": "indicator--b9f9f652-c151-4daa-b332-dcfcee62d8ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dfb7cb8-7e29-43bb-bf46-988a3b304d82", "sighting_of_ref": "indicator--fd44c5a2-13de-4a53-9f60-f5ab63793d7c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62c0d150-82c8-4f16-ad07-a72860330ed8", "sighting_of_ref": "indicator--1d454510-8f5a-42ca-b44e-c3dc1e78958d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8b61a5a-97c6-4dae-87c1-6e35abaec861", "sighting_of_ref": "indicator--6d8b3304-2b02-41f6-8f11-98eb661a22de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f8303da8-a4e3-4095-a31a-9a6dbbc60424", "sighting_of_ref": "indicator--ea5c98ad-a4bc-46cf-8dbb-de7b6f7340e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--591e655e-a525-4785-8474-db375b27e8fa", "sighting_of_ref": "indicator--fbbc4432-4e79-41f1-a34c-35fc5d4129ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee388a2d-8713-4b5c-aedd-5cc0222c1b5b", "sighting_of_ref": "indicator--18ccf08d-8caa-41df-8d0a-95844ac8c224", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b54a743d-5d3c-4be7-b052-11411650c489", "sighting_of_ref": "indicator--127f2731-1135-4f7a-a7b4-77a400687ec1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a1430f-f81c-4250-9ae0-ac98f8868110", "sighting_of_ref": "indicator--65450d68-eb1a-4822-a9be-9af6f041bd4c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fae3e4f-e385-48a2-9b27-a4f863ea653d", "sighting_of_ref": "indicator--9154c934-3db8-48fc-a5b7-58d340d98dda", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--beae94ff-6bc7-4107-a1ed-cc904a722312", "sighting_of_ref": "indicator--e5e27469-fa5b-4e70-bb11-c9f577997322", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4eb04cd7-610e-4756-a6a8-ece9c68e61e4", "sighting_of_ref": "indicator--3e23a47c-5d4b-4c27-9045-a11618629ad3", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14242cf5-e168-4685-b6e3-d130fba8e950", "sighting_of_ref": "indicator--8ceac63a-e26c-4aec-b0b1-ee48389c5f28", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e3db41e-4b87-493f-86ab-82913f1f7b39", "sighting_of_ref": "indicator--0e3e7483-b0e1-4e81-b53f-a641fc970d9c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3e7b59c-cd7a-4980-93ae-25e102759a57", "sighting_of_ref": "indicator--5074d72c-ca8d-456a-9e3d-b3e3ab3044bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--664be7a3-f214-43a0-a3e2-84aa195838a5", "sighting_of_ref": "indicator--04979367-5017-44ae-b414-26b78757a21b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e185190-6192-437a-b9f3-84cb31ff1af7", "sighting_of_ref": "indicator--eb7ddf7c-727e-47ff-a3b5-7c6d336741d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--131a71ef-2443-431b-bc50-28894c3cba37", "sighting_of_ref": "indicator--5b1a1a55-d085-46e3-a2eb-43a15b4413a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--822f1645-7908-4c8b-9f16-9b9c5c077071", "sighting_of_ref": "indicator--2dc498dd-7032-4c66-bca7-5050a39eac98", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3b2ea31-1d4c-4014-a493-b89adba1cb95", "sighting_of_ref": "indicator--788444cc-ee72-4f58-909b-8f6460c01e51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb9c438a-3d01-4c0d-821c-eb3e25cd8b37", "sighting_of_ref": "indicator--f800c3b2-0df6-4eda-8186-38e8295d62e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecc6844c-c1bd-496b-9f20-97715bad263e", "sighting_of_ref": "indicator--04874ddb-a7ac-41de-9881-80098d33444a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d1c859-1714-48f0-aac6-7476e9ceb932", "sighting_of_ref": "indicator--3952bebf-4aea-483b-bcd7-d853b8058b07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d25dd302-85c0-4920-afc7-9de81e29e6aa", "sighting_of_ref": "indicator--704ce900-9103-4bd3-8821-59160a920bb7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e66e0c25-e138-4eb1-a272-0f5ae7739f6b", "sighting_of_ref": "indicator--e2b62740-2902-45a5-ab43-034a182e20b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c86e114c-0f51-447a-a117-04f0d0b8b552", "sighting_of_ref": "indicator--5efbb34e-baf8-42f8-97c5-a493975fffd7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--444d719d-3446-4556-a910-a667b8820e99", "sighting_of_ref": "indicator--6cbd0cb1-ea56-43a4-9bea-51bf408af2f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57ba43ac-b5f8-4330-8e3e-0b1788c3c473", "sighting_of_ref": "indicator--c3ae58a7-faf7-4b19-98a5-1f5f1a4b5988", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ac93ab4-ff3f-4f34-a546-f69e40712c32", "sighting_of_ref": "indicator--247ec672-a5b5-4620-a25f-9ad3ef65e55c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39c823a5-6824-4d7f-bb2d-c40571bb5ef1", "sighting_of_ref": "indicator--27f82320-8b0e-4e5c-9731-b10d47db6112", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--671b4657-9727-402f-b77a-c37b8b8883bf", "sighting_of_ref": "indicator--563efd26-1aa9-48ec-acf4-b25d655829f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696ce4da-ffbd-4d17-824d-651358ff93cf", "sighting_of_ref": "indicator--ade6c2ab-3883-4cd5-9b46-2279aaefe06e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--631adbb1-ebea-418b-b8d1-f1bfad7cc02b", "sighting_of_ref": "indicator--b3d848a8-52e9-4370-992b-737dda8c5842", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ff2bc0a-a533-4c28-be2a-7dc827b86dd6", "sighting_of_ref": "indicator--5ee04736-fa85-44ee-97b5-80ace4e64c07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9119f72-dfe1-4caa-8ae4-a48548980f5b", "sighting_of_ref": "indicator--cf76e02d-8778-46ca-90ba-2b8f0f0dd27f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736f4827-cf31-4766-a49c-fbe7a5daef6d", "sighting_of_ref": "indicator--d446b0e9-12bc-440f-ae7d-a8d15e71e92f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7a06883-9d54-424e-8d0a-8f55ef83f439", "sighting_of_ref": "indicator--8ad1d9db-a009-4eb8-ab23-988a54819e02", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17682a1e-b3e9-4c35-badd-260b6f3ac388", "sighting_of_ref": "indicator--ca1d0451-827c-46ed-9562-77089289c7ef", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e06909dc-4f27-4987-8464-808c5ee3c6c8", "sighting_of_ref": "indicator--e7f321bf-e6a8-4c7c-9c33-c9b7a183ea5d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--903a82ef-f15c-404e-a824-6d56557046b4", "sighting_of_ref": "indicator--2d34a389-f52f-41ee-992e-eeac662f39a1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4a32a5e-dcd3-46f7-b5c4-388caab6694c", "sighting_of_ref": "indicator--b37292eb-e868-46ec-bc7f-f87b9b2ed86c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9da5d14b-5f9e-4817-b4a3-e375cdddcda3", "sighting_of_ref": "indicator--54e962ff-88ac-4b86-980d-a9bfd000e0bb", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b994d0b7-05e6-471c-9c42-18dec400aec8", "sighting_of_ref": "indicator--36450077-b21c-4d4f-890a-edc36b5e130b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2063e8c2-e32b-4a81-955f-e5565df3e627", "sighting_of_ref": "indicator--c734028f-ecb7-4471-9ecc-64cd91dea494", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0453a510-7450-46ff-b96b-e07e3621adea", "sighting_of_ref": "indicator--edb7e667-6102-4583-a2fa-ce9e1c596bcc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b9d944-d3c0-483f-bcc6-7f504e74320d", "sighting_of_ref": "indicator--d211edf7-f233-45d4-8c72-47d98c6d8174", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00e65bab-8884-48f8-9b36-bd8494382a57", "sighting_of_ref": "indicator--8c866816-54b2-4351-9e69-f49d8c15cb82", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8b796fd-1e85-4f63-a61f-bdaf7d25072f", "sighting_of_ref": "indicator--bf48d634-29c7-4d8c-9fb3-98eff2247604", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--739390c6-2af4-4885-a4ae-5af545960280", "sighting_of_ref": "indicator--7adca3cd-3216-4553-bfa6-c451423b43bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9778110-3be5-4791-a5a0-e792557e455a", "sighting_of_ref": "indicator--99afdbb9-7d85-4cdd-8496-e7053bad327a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79e7d07f-af53-411a-ba7d-c3e8329892c9", "sighting_of_ref": "indicator--ef7fccc3-cb4a-45fd-a747-b9d8aa74fee5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0be225e-bd1e-4d99-a416-c2d7477a90ed", "sighting_of_ref": "indicator--ab90fff5-e9c0-4d2e-936a-196ec88bd121", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--203de085-6397-4708-8333-0fd5736664fa", "sighting_of_ref": "indicator--48467851-212f-4401-84d6-5a0f0f1f80de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e5f66c5-0e76-491b-9021-acf665f71dbc", "sighting_of_ref": "indicator--df6b280d-bc3d-4d95-91c8-9f12daa17a0d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f95df94-ad77-4d0f-a9a0-e3f82ee04206", "sighting_of_ref": "indicator--1ddfe239-4f73-4621-92a5-c709c8a74f6c", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ef002d-3e70-4a09-8f08-69d4c89dac37", "sighting_of_ref": "indicator--39480def-bad2-4893-958a-9a7241944ab6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--089d111a-9b5d-4b5e-a91c-4580c1a32c17", "sighting_of_ref": "indicator--fb497c92-675c-486f-9f09-2bef265d4b5d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19c34ce8-6fd3-4148-8776-bb0e9b87821a", "sighting_of_ref": "indicator--07295789-2906-4f59-b2d2-6d985ecda721", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172eb69c-4edf-4a9f-a183-933e537456ce", "sighting_of_ref": "indicator--86e983d2-cb3f-4f97-828e-163c08d35c5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--311d29c7-614b-48e8-8c2c-eda3f09ed3a5", "sighting_of_ref": "indicator--ab5ea712-cacf-47c6-9d44-cfc891e79955", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d929fb0d-6144-4be9-ac88-6fb925b2526c", "sighting_of_ref": "indicator--f939eb08-2177-4018-8014-eb5b6f78b076", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cc926f-f972-4d32-aa50-42b2d1e1f19d", "sighting_of_ref": "indicator--70113332-a496-41ca-853f-5a362f850267", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f476ab63-349b-4b7c-811a-02f915897148", "sighting_of_ref": "indicator--e1248a5b-0a54-43c0-b46b-55e3a862e9c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2a8bc5e-6cf9-4fdb-95af-74fbde60638a", "sighting_of_ref": "indicator--f52d070b-e25b-49c3-918c-162eb4f05c52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24fbcc6d-8bb5-4039-971d-a6281c967c56", "sighting_of_ref": "indicator--78d03121-388d-49f0-b29a-df2bf2e2d42d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07d4f1f7-361d-44ff-b7c6-ec606b78c227", "sighting_of_ref": "indicator--fa038353-07d5-4111-a456-6f18c894f461", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc9fa32-fc27-42ff-884b-065aab01bf4a", "sighting_of_ref": "indicator--f6b7121e-994f-4d1d-befc-6ff7747dfbf5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df70721e-632d-4a88-b71e-1379d915a2ab", "sighting_of_ref": "indicator--124db511-0f6b-47a1-b26f-f81aba3accc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1c804fd-38e1-483c-9065-84198df4bdd7", "sighting_of_ref": "indicator--6b3fcdd9-4ddf-43f9-95cf-a808f3e1dd4f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--060f315f-77c0-4fb7-8018-82912bcfce31", "sighting_of_ref": "indicator--d566f202-c1ce-492b-a4f4-41a7bf4a4aa6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f762256-a61a-41b6-acca-b98bdbc104f8", "sighting_of_ref": "indicator--f055319e-8cc8-4d33-a6e0-1ac706d736a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1a7c4f6-c6bf-402f-9db3-4850fb46a894", "sighting_of_ref": "indicator--b508d724-a69a-4ff9-9c1c-d64d53f1a046", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--144ea21f-c1c6-4944-91f7-97d174e44022", "sighting_of_ref": "indicator--f29fde1a-bfe1-4af3-b098-047d8babb1ea", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1eee1e5-2bed-492d-9254-44cc525a4271", "sighting_of_ref": "indicator--f29fde1a-bfe1-4af3-b098-047d8babb1ea", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4605620-7f5a-4979-b71f-58fc95b46795", "sighting_of_ref": "indicator--73e11f05-a193-418c-aa17-446b305c8b41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99318457-cdb3-46b5-9747-4c26c49804ab", "sighting_of_ref": "indicator--b70a0ebf-4ec1-4bb9-bd51-9dceac6678f5", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d92405c-f2b5-4b88-93e2-d2b4a4ec21f1", "sighting_of_ref": "indicator--b70a0ebf-4ec1-4bb9-bd51-9dceac6678f5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c70f891-571f-4cd3-986a-d232738de919", "sighting_of_ref": "indicator--794c5ad9-8289-45f0-a9db-6c6b64608b86", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcf5bb89-7342-4f33-8f40-de269a7c673d", "sighting_of_ref": "indicator--511f53d6-f761-49b4-97db-9cda24533c3f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3095169-f7a7-45e2-b964-56e848b23a7a", "sighting_of_ref": "indicator--05523f57-164a-477f-be8a-d5ffbe07ff62", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8a810d8-6d37-47e1-8e34-498a33dbfac9", "sighting_of_ref": "indicator--3babc0f6-e9d9-4352-a79b-f2d6c26e6964", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c48df8df-492f-4be2-afb1-78638ca8eeb7", "sighting_of_ref": "indicator--69b93ae9-8149-47a7-945c-1249d3d1cf3e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c71f4bac-b645-4b07-9d6f-76f6c125b491", "sighting_of_ref": "indicator--8a1d4bad-fcf4-4e48-8277-78645a0a3db4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c149efd-9d9d-4ca0-9092-076e64ba57d7", "sighting_of_ref": "indicator--cbf53d0c-d41e-460d-b9ae-68de3ae41848", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f911e57f-96df-478b-b2d1-e0de450dfe20", "sighting_of_ref": "indicator--a73c024d-1ec4-46db-bad4-53dd3a749878", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--add7098d-1d1d-464a-a958-4e061b6ca885", "sighting_of_ref": "indicator--39343ce0-7635-43ef-b96e-f0718803be8b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9b36359-a467-4f00-9daf-4e0345fe0492", "sighting_of_ref": "indicator--c289307e-2f95-4f4a-b04d-549e6105abc8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee87529-0ccd-4639-9b27-a801d35826a0", "sighting_of_ref": "indicator--a5afaddf-4c77-4d41-aa22-e22bf9cc7f95", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--578393eb-3dfe-4c71-a824-ea9d622da451", "sighting_of_ref": "indicator--2182999d-4983-41a2-a2d9-9f7a7806713c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6b1352d-6827-440c-bbde-1008d87bc73a", "sighting_of_ref": "indicator--9e22ff77-65f4-4d78-a2e1-96c14bca3677", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60b1bff5-e5ea-4cb1-b09f-24e0438edb2d", "sighting_of_ref": "indicator--71d878ae-b023-41f7-90af-ddb5cdc2c2f1", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5398998d-2d5e-44ad-8cb5-aa47f17a051c", "sighting_of_ref": "indicator--12f50b27-c19b-4a41-a218-0b732f385e1d", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f80797d-3c26-4a96-b1d2-cebcaca3b978", "sighting_of_ref": "indicator--6512fcdc-9fa4-4cdf-af90-0aff1687ac2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--303dbcbc-bb9b-4128-9cf3-dc7429a9043e", "sighting_of_ref": "indicator--c41f0941-294d-4367-ac4c-9e5b1b67f28f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d49cb0bf-a45e-42ce-a1bb-c2deca72116f", "sighting_of_ref": "indicator--758d3a24-9372-44d8-be0e-15adde34d27b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622ecbe8-8bc4-4160-8d18-88aa8b3fdb7e", "sighting_of_ref": "indicator--fd92120c-7c93-4aab-a638-e82905ae6b0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b99f306-7b02-4f70-868a-408ac0078444", "sighting_of_ref": "indicator--0752448a-6bba-4a80-9fd5-6334c0c5d536", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--363d84e7-c35e-452c-907b-4584f03dead7", "sighting_of_ref": "indicator--6f290387-1886-42f9-a9c4-7fdb74f90b6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bc88f00-a052-4735-8603-f43590d53f5e", "sighting_of_ref": "indicator--13cc5a17-df71-409c-9095-dd8c3ffe70ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e859b39-1604-4e33-b529-a13f4d927047", "sighting_of_ref": "indicator--c3daef11-7064-42bc-8486-2fd3428e1b01", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb902ade-c417-425e-b0d7-11f55bd05262", "sighting_of_ref": "indicator--548ac1ea-115c-4373-9c0c-c142197b6815", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d379db3f-ee3a-4c3d-ae16-60ed8534bcf4", "sighting_of_ref": "indicator--ce123f13-4c2f-499a-a8f0-aecdff1c06ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74ff098-6d85-4c59-a739-631087281f24", "sighting_of_ref": "indicator--02b3790b-06a4-4f35-a0d5-00637aa776d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3e616dd-eaaa-4c6c-92c9-705fc546230c", "sighting_of_ref": "indicator--443ed0d6-a981-49d3-b47c-e93bdc68246b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff8b761e-b7c2-482b-b433-651c5d790558", "sighting_of_ref": "indicator--0c4740c6-c932-4d9f-bf82-b1a7f9543eff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d260568-1084-4cb2-b49e-8ccaf6acf532", "sighting_of_ref": "indicator--d49a25f0-5999-4f4e-8ade-7ff0e3c311be", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31e13d39-d5fa-4558-9e8d-0f1627880bf6", "sighting_of_ref": "indicator--c496f97c-3773-4b20-ac2c-69a20b443c90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7739a17c-1fb6-4356-9122-90009c8682d7", "sighting_of_ref": "indicator--f7c66d72-6726-42c9-9993-6c118432bd6e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11df9a2c-856b-4325-a284-0d5f0c3e5e0b", "sighting_of_ref": "indicator--864ada06-230d-4bba-abf3-3039598937fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebc7479e-bd1a-428e-b71b-6a8fd34a2b27", "sighting_of_ref": "indicator--ab584665-77d3-48b0-8a5d-8fb3d8921b12", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbb79e0f-f143-4fed-8838-8f3f94122249", "sighting_of_ref": "indicator--d42a516e-2b68-454c-891d-88a59a630d80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--655e2c93-fc16-4615-bddb-502439787867", "sighting_of_ref": "indicator--3ca0f212-4cb1-47f5-99e1-4a75e26eb5ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ea3580f-042e-436f-90a8-68c8886d5b84", "sighting_of_ref": "indicator--3adfc66b-2f99-49d3-93c0-ea6f328bf5a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1430f566-29ea-42f2-b0b1-6058c1b094b5", "sighting_of_ref": "indicator--0241c0fd-e515-4237-a834-bbc27f7179f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4629d8d-8c25-44b9-850f-66e7b347e23e", "sighting_of_ref": "indicator--7e0dfa3e-aa50-4338-acd6-573c490d1754", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80930433-c55d-4d18-a07a-7b47c7bcf73e", "sighting_of_ref": "indicator--f275f2e2-c6f5-4e0d-9448-efc35c7c883e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2929b544-7c67-4fba-99ae-86af9573b7b0", "sighting_of_ref": "indicator--305e9726-ec3e-455a-b07b-e6b8f1cd667e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05386864-d037-422f-b9df-2fb9f33a4abe", "sighting_of_ref": "indicator--76abe7e1-c0ec-4cdd-af8e-ddfede7746f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01d3f6d2-7e24-4f69-9175-9d9c18c41ecc", "sighting_of_ref": "indicator--89b640cf-11f5-4a3f-be84-f18c632e6473", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0538f467-3705-4b09-b344-4a6feb2ba627", "sighting_of_ref": "indicator--e1f1f761-0726-4d9b-8dfa-e826bbe6051e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c518491c-d6ed-42be-972d-b97a2f523df1", "sighting_of_ref": "indicator--6adbe88f-12eb-4f9d-b09b-f4efaf9791ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3612ef15-0244-4b06-98f9-e0379c6eca9f", "sighting_of_ref": "indicator--dddc66d7-7f1d-4587-9f7e-8a66561eb543", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a151e653-c45c-41c8-80ad-ff6db9a8883b", "sighting_of_ref": "indicator--2ac7e243-2b8a-4f81-97cf-d8c715c1ab7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ad1b960-e034-41db-a3c0-31ea5ccc403a", "sighting_of_ref": "indicator--c35277e5-e904-4576-85b8-0769c51dd325", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee9c7a28-1057-49a3-9e56-8e404bd3bc24", "sighting_of_ref": "indicator--48fa3048-7348-4850-8aea-ccdf6f7b5ed2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c8eb13c-47f3-4202-8cb7-c3c0f1734ad7", "sighting_of_ref": "indicator--11533dca-a08b-495d-b7d4-18902f762b0b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b33bf98e-5956-4a4e-a760-a30514b2c0cf", "sighting_of_ref": "indicator--348ae482-65ad-4298-9b14-a56c1528ebc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7a99627-de43-40ef-be43-0380f30b330f", "sighting_of_ref": "indicator--3b524bbb-a3a0-44cb-ac4e-1ab2735884db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e7d051c-6404-4e95-aec9-928e403c7cde", "sighting_of_ref": "indicator--4fa22829-cb3f-404b-8369-ebda431934a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d04a2766-7ffa-43b4-95cd-3008d348ee3a", "sighting_of_ref": "indicator--b674007e-ccb9-4618-97b6-95e55cbfcb21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0acc709-c29d-4c49-b04d-bd0cf8909cf4", "sighting_of_ref": "indicator--795c5b63-be8d-42b8-8814-29b98fc3475a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bce74d49-5cce-4a54-9a6a-f66c7f8ead93", "sighting_of_ref": "indicator--f3e2e7d4-d784-4aa7-b4de-bd2df46006cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f88fe85b-33cf-4f7f-b260-06e9012a6f02", "sighting_of_ref": "indicator--23a62089-a4ce-4662-8991-b7a49e31dbfd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4cccf26-73dd-483b-a96d-5aded201232b", "sighting_of_ref": "indicator--ff1e15a9-5050-415b-913a-23818bd8ba26", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c8fca12-2403-43e5-b99f-ad4611d9ded7", "sighting_of_ref": "indicator--c1a3dbbd-5abc-41a7-9ab8-301b55e796c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec20747-ee78-446f-a55d-f51822c1049c", "sighting_of_ref": "indicator--ffede2a4-6ea8-416c-968f-43aece24d44a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83e9d7ad-7514-4026-826b-ca544553b1e4", "sighting_of_ref": "indicator--0c00a01b-ec01-449e-b76a-dcd78b23f6a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c77dac45-c9ef-47ae-8d37-dbbd8733eb5d", "sighting_of_ref": "indicator--82c0dadb-756f-4aaa-8bd7-fc7158a06f9e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--981fbbd0-8f25-43fa-90a2-5910cccce7e0", "sighting_of_ref": "indicator--692e62ad-86ef-4c17-9723-7dd7f030f785", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8ce509f-529d-44f2-ae9f-03ff4929a67f", "sighting_of_ref": "indicator--a7362135-7cee-4cf0-a77e-9b694feb0314", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53148596-c902-4cb9-9af5-d3952d190290", "sighting_of_ref": "indicator--aeca41ae-27f5-4e45-a89d-aa0307b657f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5eb562c-eb2a-44d7-8cd7-33bff650cca0", "sighting_of_ref": "indicator--0b4524ba-6e9a-41f7-9304-35c3555051e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35ed57fb-32e3-413f-ac30-443594e656fa", "sighting_of_ref": "indicator--4d68804a-99bc-49f9-ae1b-a951f7722eaf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb8313e4-c731-42b8-8c3b-68660907dfbe", "sighting_of_ref": "indicator--514698d5-2aac-4dcc-9eda-dd9042eca15d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5fb3663-c8c9-4ba6-9880-5d1846647ac7", "sighting_of_ref": "indicator--e5c9cd55-1caa-4d6a-9116-a5b671388cf1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--999d0255-09d9-4d79-8e22-c901b229a2cc", "sighting_of_ref": "indicator--45e03775-1bdc-4f8b-a1b4-3fc665e5617a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bae9357b-4e8b-4a0f-b90b-e83ff9037e43", "sighting_of_ref": "indicator--c79cd3bf-2c36-4efb-a260-42cfc7118b75", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b4483f-e26e-4865-9b8e-525d0be4726f", "sighting_of_ref": "indicator--369c849e-a9f0-451e-8074-0214cb97936d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--229feacd-5cc3-499a-a425-12194a1f1cf8", "sighting_of_ref": "indicator--17a97f16-4e1e-4f59-abe2-57538910eaff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a5133b0-9f7c-46cc-b705-bc407e5d02fd", "sighting_of_ref": "indicator--5f51b342-8760-4210-8898-e221712ef2fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c003a7eb-fcd3-4429-a39e-25214d0b49aa", "sighting_of_ref": "indicator--e624d62b-8458-4e80-add2-692ada7bd5d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2f7fe20-2d33-4dfe-b5af-b57819cec247", "sighting_of_ref": "indicator--83c81c72-252c-4450-a4e3-d9b7004e7713", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4589e472-0c8b-469c-9d2c-362e0b0aec4b", "sighting_of_ref": "indicator--2f4aae41-6727-429f-b7ad-1b3e9f7ed6e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b01cd973-bd68-47e4-96ea-3b693f3c787f", "sighting_of_ref": "indicator--e28e0197-610f-42b2-8282-a1ecb0af6f8e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--286c30fb-6d83-4aa3-a527-f0123214bb79", "sighting_of_ref": "indicator--b22553de-88e5-4df8-9e9a-5a1dbf6415e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ba2247-2f53-4d2c-a0f1-7462270c878f", "sighting_of_ref": "indicator--b6f4e465-5410-44d2-9aa6-5ab430967493", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e3b0f8d-99c2-46a8-95c1-b283b883e0a3", "sighting_of_ref": "indicator--7be96c85-511c-47bd-bb08-2b0b71ccad94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e8e2083-e516-4ff4-95fa-c96339c1565f", "sighting_of_ref": "indicator--f7fe363f-e4fe-4c53-b050-c99b4dcb5bf6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb1b7f82-d7c0-4d49-b323-6ba28b14b738", "sighting_of_ref": "indicator--8b32a28d-d9ba-4621-86c8-2d7ce3317b75", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c76b41f-199b-43e2-bfa8-3a840201da26", "sighting_of_ref": "indicator--f4f3ee37-8b3a-4417-8de6-fd1aa8d2a8e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa8d6bde-abdd-40aa-87e2-b5ec190dcbc1", "sighting_of_ref": "indicator--02405325-69e7-4b4f-b4e2-a02293c1a0ad", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f545cd0-83ae-49e8-8817-60464459c151", "sighting_of_ref": "indicator--02405325-69e7-4b4f-b4e2-a02293c1a0ad", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--614eec95-169b-4cff-9d9a-c2ce1a4a4365", "sighting_of_ref": "indicator--cd3b4c60-420a-4fca-befe-785dbe13b74f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ead06f68-5a14-4b1f-b000-7c64956ee08a", "sighting_of_ref": "indicator--cd3b4c60-420a-4fca-befe-785dbe13b74f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3779840b-53e6-4d5d-a5f9-27df59538a7c", "sighting_of_ref": "indicator--135a62aa-6569-404f-995e-e464d7bade86", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4f80667-c6e0-46a0-a90f-f54e7fd0c067", "sighting_of_ref": "indicator--f247b3bd-2064-4a7a-94fd-727bcde3c94e", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e76798f0-10b4-4fc8-92c1-bf5a2fda45d7", "sighting_of_ref": "indicator--9c675d3d-9e03-4a8b-95f7-d8119a1fbdd5", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ead2e2-8a35-42fb-9907-9612aa8e1f5e", "sighting_of_ref": "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a0e3fa6-a1bf-42f6-ac1e-1bd9990499cd", "sighting_of_ref": "indicator--c7dcc9fb-dc61-4dc9-a93e-48d45106411e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48886b5-2d51-4c9c-9367-6463321818aa", "sighting_of_ref": "indicator--7dccd831-d642-49c4-b46d-ee561d471762", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13650c22-0192-4321-b65e-31decde45d4d", "sighting_of_ref": "indicator--631cb4c0-d2ad-4cbe-84dc-01e698edf57d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a76816c3-5a6d-4ad2-94b4-30a860f5291b", "sighting_of_ref": "indicator--2f3f0291-2baa-4ca8-9161-ef81347cb4ee", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d64decb1-b01b-4ae7-94ea-47c5809ea7e5", "sighting_of_ref": "indicator--b3810a84-bbfe-462b-93f1-9813cc2cdf52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f36ee85-6e31-444f-beec-803fa5a3fbf1", "sighting_of_ref": "indicator--e26d7fef-f45d-4e43-9911-3e81b6612f5b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d37f8394-e855-4746-b81a-830f6068d925", "sighting_of_ref": "indicator--29ad58f6-5adb-4bab-a368-60d68a26769e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67338586-63b8-4a1d-b91d-6a5dda05e9b2", "sighting_of_ref": "indicator--06533366-08f9-49e8-83aa-b94fcc997be5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43454461-15e1-470d-a4bb-11de6b96adae", "sighting_of_ref": "indicator--38d75ffb-af4a-4e3a-a796-20e231e2f003", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c931d38-cc2d-4ab3-a7f8-a232c2fe9cbb", "sighting_of_ref": "indicator--29b059a6-1a35-4e8b-bc9b-7a20e9221226", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458211f1-ed9a-4f5a-9e1d-2a009e7c738b", "sighting_of_ref": "indicator--13b9ee4b-aef1-4ecb-b978-e46281dade59", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e5b728-0d7b-42f9-8cef-f41c48b4c26e", "sighting_of_ref": "indicator--e5ddc2e7-8f55-400d-a3b1-374547638c5a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a89ebe3a-d284-4e60-8d2e-454516b98cb3", "sighting_of_ref": "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--057e8c69-0e45-4959-9b51-ed73259376f8", "sighting_of_ref": "indicator--aa33d9ab-053a-4dc4-b839-9d98cec4cf9b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ed83eff-0cc9-48e3-b926-6d4a7454ac7b", "sighting_of_ref": "indicator--f1a271df-dfb2-43d8-92fb-2839c84e1612", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--10229755-5ced-4aa3-a49e-01db52815e11", "sighting_of_ref": "indicator--24bd1ad4-b100-4cf4-9c32-aaa4c47457ed", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--475878c0-c278-4d33-a43c-a897db94e4ab", "sighting_of_ref": "indicator--4e15b60d-8957-415c-88d7-f0f2c6f42665", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2130b293-ed75-4923-af6f-275115251ff2", "sighting_of_ref": "indicator--547ce0be-1c2e-4e43-b1c6-512e37e50d8f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce8f2a59-e612-4948-aa2d-522d03ad2de5", "sighting_of_ref": "indicator--fa0f5a5a-54db-42fb-ad07-30e9cf63c736", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f53ce924-e92a-42e4-942f-06b44b5f4312", "sighting_of_ref": "indicator--d9582e77-c29b-49c7-928c-af4d057f3a94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0627cb7e-d503-47d6-a043-08324bbd0be4", "sighting_of_ref": "indicator--39526912-80d3-48b4-a8d3-d2782bf64cf4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87d3a2bc-0f12-4b46-8618-73a0f1d14607", "sighting_of_ref": "indicator--c9876404-23c0-4448-a02f-f03b8c0c87f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df88b868-2167-4181-bec4-b2a878844b78", "sighting_of_ref": "indicator--12ac7388-a367-4690-b957-e64fc4de7147", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55bb59ab-b513-4326-8157-7bf4d88916af", "sighting_of_ref": "indicator--4bd1962d-823a-4013-8a74-4c55666fdedb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e78606ca-5a17-4393-95ad-c4d90cab34d8", "sighting_of_ref": "indicator--baae4fe5-40b7-41cb-8541-3ab33c6dad3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efde52b4-f33f-491f-b0cc-e19690e61df8", "sighting_of_ref": "indicator--b10c2a9e-133d-435b-9623-548bb5f50f65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58c1f6f4-ff37-46ea-9474-8ecf7f32bab5", "sighting_of_ref": "indicator--d51835c7-2401-4b5b-822b-b18c68a23f65", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13769cc1-1afb-4e68-9df1-9032d176be81", "sighting_of_ref": "indicator--3c4d4eb1-e1d3-439b-badc-ae8a48af429f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9188ee44-0c50-4c9c-b22a-f17818577bf6", "sighting_of_ref": "indicator--1c81a382-164a-4d00-b1e6-00940f171e3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53e3f9b0-3f80-4c7c-aa23-b324aafe261a", "sighting_of_ref": "indicator--228ba11a-b1ba-418c-9f15-dba6516589ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b81edf7-45bd-4036-bda4-bc4305385cd7", "sighting_of_ref": "indicator--49ccdee5-6f27-4dae-a74a-59cfc7cd1e18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ab161cb-bfdd-4952-a822-3705253afaf6", "sighting_of_ref": "indicator--b03de004-47e7-407c-8e2e-43e18dff44e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d0ac847-b571-4313-be4f-095ee30fe5dd", "sighting_of_ref": "indicator--6bacfd92-b2e8-49ef-abf6-23cdeba3cddf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b189deb8-0f9d-42f1-8eba-b1041a44a46b", "sighting_of_ref": "indicator--7bd55cb5-ac43-4aa5-9227-edc8c791404f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4f45b4a-f45d-4f97-b8fd-ff7e895093be", "sighting_of_ref": "indicator--196ed3b3-74fb-43ae-9727-e8a8c012da1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc5ef82-8496-4458-8a27-9b28f13771a9", "sighting_of_ref": "indicator--c7018382-ef05-4bcf-bb1f-2f53ce179670", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7927eafb-4ec1-406a-8f67-83b10155ddfc", "sighting_of_ref": "indicator--24c9f6bc-6786-4ed2-86dd-e339c6eafee4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d81391-3a29-47f3-9c21-d6c14cd33c90", "sighting_of_ref": "indicator--24c9f6bc-6786-4ed2-86dd-e339c6eafee4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adc7a5e2-a33c-4893-8176-f38aa8ea70ef", "sighting_of_ref": "indicator--22f23f13-a99f-4c5b-bff8-336faea451f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--34270e9b-7abc-4a40-b1cd-b1e154feed80", "sighting_of_ref": "indicator--c33a12d7-bf64-47c8-886f-3e1d24eb1c21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fba68ab9-b9f7-4bc0-bc15-af514b64ebf5", "sighting_of_ref": "indicator--7e721a8a-b993-4c93-9381-0fff773dc5bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918cd211-e352-4dae-badd-456f99ba62ea", "sighting_of_ref": "indicator--46912145-c78c-49eb-bfcc-9a812593f4ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee944bad-1a43-44cb-a26c-77c15dea6e03", "sighting_of_ref": "indicator--ccd07e4d-a553-41d9-b083-968cd91cd24a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f7894ab-70af-4e3f-895a-486c3b7bdf33", "sighting_of_ref": "indicator--1e6cba27-6c43-412b-aded-9f46aed39580", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77078dbc-4f65-4059-8f91-473b340242f4", "sighting_of_ref": "indicator--0462df37-b51b-48b2-b601-b6f547af8311", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a32d7aa-c16c-4391-9a23-3d0864b19b07", "sighting_of_ref": "indicator--75228610-2aed-4adf-9e91-63813ecb5c0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--058ecce4-0350-41f3-be70-c6e8a8bddbeb", "sighting_of_ref": "indicator--d1dc4b4d-303d-4210-acb8-b857054d1c3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6069002-dfdb-4400-945d-df1ff257fc10", "sighting_of_ref": "indicator--eebfacc3-d1c5-478b-8841-eaec0520faf5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bbdd981-8496-4a17-9582-4c11ed74d5d0", "sighting_of_ref": "indicator--64d97d70-93a7-4075-99cb-c8b0e035ee16", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a56dd7c-d190-476c-bacc-3c4196744f82", "sighting_of_ref": "indicator--bb06dc9a-0f16-4787-88d6-3e2993d0846c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7fd153c-4ff5-456e-98ab-371a824581ec", "sighting_of_ref": "indicator--2c020b98-84ca-401d-a9eb-223da8d0d530", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--baee9a00-4bb1-47af-baeb-be5a9b6b78e5", "sighting_of_ref": "indicator--8b52f9c2-62a5-4089-8fc1-22108753e659", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4748387-48ab-4345-ac13-10138c46ae8d", "sighting_of_ref": "indicator--dc3e75a1-cb67-40dd-bdde-1bde77940571", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35e6d550-a079-4e93-9305-a464ebc31807", "sighting_of_ref": "indicator--996890da-4f74-4d1f-9d06-2cd418d19ad0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e768fcb0-9f9d-43b1-bd2e-cda6886666cb", "sighting_of_ref": "indicator--5896fce6-51e9-4f03-a52c-46faf7b1936d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c1c46261-be7d-4198-bdea-ee492d583db6", "sighting_of_ref": "indicator--09a2d9ed-9153-46bc-9e60-40989f24ee31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab2408ec-1153-4eb5-8579-7621aeab9af1", "sighting_of_ref": "indicator--4669ba6e-4700-48dc-8fa0-566673df6e7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69ee4e64-b8d7-40c0-b8f8-ee4e15de2160", "sighting_of_ref": "indicator--bbe7385f-aa11-4b7f-b6f9-c7ad7263a9cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0adf4ea-bf25-4cba-b6a5-e410b3275e5d", "sighting_of_ref": "indicator--46fc8ea0-8105-48a8-a4ba-381632356578", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c19e6c-50f5-47ba-80fc-5587a408f643", "sighting_of_ref": "indicator--68cf0e5a-ad5d-44e0-a03d-fa76d54b9b41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf850d58-aeb3-4735-a54c-0eabf62abb66", "sighting_of_ref": "indicator--bd9e2c8e-ab4b-4870-ac8c-873e2b2c502e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d923da9e-793e-4537-a057-7faf4810815b", "sighting_of_ref": "indicator--ecee3221-f25f-453e-9613-8a7223fa4955", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--561bcde7-36f8-4a24-a444-e28e00e7d459", "sighting_of_ref": "indicator--3301e2c8-4118-4e18-b411-c9b12ffcf5c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--48dbdf21-00cc-456d-a2e6-451384d8fde6", "sighting_of_ref": "indicator--9ce3c6ce-77d1-4b12-8910-0f795c0e63a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--073c454e-873f-495b-b81b-57df653068d7", "sighting_of_ref": "indicator--101d25be-ca52-4fd5-a69f-10625cf71535", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75240cc8-a61a-403b-af94-b74b5eb5fcb7", "sighting_of_ref": "indicator--2bea75a0-030d-4a24-b093-3143a682acd8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd712f93-8642-4663-94de-f29a84c09882", "sighting_of_ref": "indicator--fbc2cfbe-a145-49c6-9182-1dc322e3bbda", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320b6afe-c1d5-4362-b280-1af69a38daef", "sighting_of_ref": "indicator--f50fab29-9a45-46f2-900c-7c28154e5fc1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0babe5cb-1f57-45a3-9df5-d0dca09b3ce7", "sighting_of_ref": "indicator--ef98938c-5d1d-4815-9c65-e79f9c9d40a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b82846e3-37ca-4bac-8b62-b4e723baad3a", "sighting_of_ref": "indicator--bbbdbb88-b401-4170-8346-f51a905ae7ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57f1e4e-4402-405c-ba32-adeda36d5d7e", "sighting_of_ref": "indicator--cfb25fff-8c96-48cb-83eb-9e66170c68ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2485ad32-53c0-438e-93d0-4631c552de8f", "sighting_of_ref": "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff43f051-d5db-4ca0-974a-d51e3602bbf8", "sighting_of_ref": "indicator--31c8b8f0-df2b-4095-a7d6-068387d52870", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3cbb07d-7816-4694-8618-a9886f2e79ff", "sighting_of_ref": "indicator--a9d4ccc9-2637-4cfb-9263-2efdc37f9e04", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cbdaed3-ee19-46de-9ef8-f40a6772f3d5", "sighting_of_ref": "indicator--15e3b607-c236-4edb-8185-d5f813c522f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9634b8e2-bc60-4b4a-8c8a-24fb99a45ea2", "sighting_of_ref": "indicator--24e62b5b-a3e1-4148-bc5d-7cee4b0e3fa8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a03685-06ac-43b0-8d39-cb538c922f27", "sighting_of_ref": "indicator--065b18c1-a0df-48f0-9697-fc5f6f37dd60", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2957bb1d-a7b4-416d-a2dd-0a19592dd0e8", "sighting_of_ref": "indicator--33e98975-c216-4de5-b50d-5f6021d292a5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db2d52dd-e334-4d95-a212-e13b67e6bd23", "sighting_of_ref": "indicator--c6297939-4ca2-4b28-aff1-e9afcb0281f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d442ec9-634e-40d7-905b-8dcdfd7173a4", "sighting_of_ref": "indicator--db4e43c9-5067-4771-b8f1-d552bf71c145", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2be90bbf-c88e-4482-b287-11a30d2922b6", "sighting_of_ref": "indicator--94cf1e19-ce29-46cf-b154-5ab3cc882793", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--799e354d-f891-415f-a66a-1bb0b197ef96", "sighting_of_ref": "indicator--319cd005-c095-4d9e-8202-86f3855d0fe8", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a85811d-f858-41dd-8fb5-12ab75d8509a", "sighting_of_ref": "indicator--4e29502c-b516-412b-957e-3507473c4ee8", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f95bcf8-90be-4161-8727-20adb5914675", "sighting_of_ref": "indicator--0e65045c-7400-4f15-a772-493075bfc521", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae7add02-77f9-4cf3-8692-736142f35763", "sighting_of_ref": "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2265f280-3258-4e6c-8519-5fbeb9f941ee", "sighting_of_ref": "indicator--3b53718d-e9a0-46b8-93d5-ec069014b0bc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--400c34f1-7bc8-4199-a352-bceca5a67755", "sighting_of_ref": "indicator--8ccdfd75-a8ae-4243-8ca1-c134b964849e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c13aa699-7326-479f-9241-a7bc9535521e", "sighting_of_ref": "indicator--5f8ff1b0-95f7-4137-aee3-b02978aa8829", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1459094-e94d-4566-bc10-02f79d766a73", "sighting_of_ref": "indicator--51532187-bf63-4563-a16b-0e7911784499", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92bd43b8-ad94-4b19-90f2-be2dfbb43961", "sighting_of_ref": "indicator--39e73e67-9933-4435-bf43-d565c84c827d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7876336d-b10b-4bb3-9e67-184b5e39498b", "sighting_of_ref": "indicator--8477282b-5968-4816-821e-6895e4afc464", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4305cc9-68f6-4be0-bbf0-6867ec8ec232", "sighting_of_ref": "indicator--4c759204-f826-4d6c-a66d-37263f8336ef", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--746b342e-d597-4572-bd06-c374632e70a7", "sighting_of_ref": "indicator--312ed4c1-b6b4-4465-910c-4157c844cd21", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c7b0025-0f6c-4ca5-baba-34bb9fa4b400", "sighting_of_ref": "indicator--ef15369b-d3b4-4834-bd6a-b7188174b581", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a24def2-f2aa-4c13-8a8d-34b5529fa6a3", "sighting_of_ref": "indicator--bbf80c23-beda-4214-984a-9c5c98da5f5d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b033f32a-d2a2-48b7-8ba0-cf9682e77100", "sighting_of_ref": "indicator--57e9a2b4-d361-4c20-a04b-d3abd3f81fee", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c225a722-12f9-4667-bbad-d7ec02d0583b", "sighting_of_ref": "indicator--782d52ac-69a2-45af-810a-61120b75e185", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fd12df-4deb-407b-ae20-669d4a073b38", "sighting_of_ref": "indicator--24e7a5c3-1f35-407a-ac98-e082aa6b877c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5975a672-6ee0-485a-aa7a-2c7d6e92533c", "sighting_of_ref": "indicator--d94467de-8da4-4652-a87c-a69a5bc33b8b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bef89b3-6289-4a62-beff-cfc87289b651", "sighting_of_ref": "indicator--6f42c210-92fd-415a-9655-502502fdfd5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca0cc2be-967a-4e2a-badf-2c94fa3048f7", "sighting_of_ref": "indicator--8c624ead-50bf-4b78-bc10-e2b686c17b8d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91650ffe-8701-4dfb-bba9-3374077d568e", "sighting_of_ref": "indicator--ed7e6b0d-fca4-4b29-b706-b43c4a0bef6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf00ece8-dc0c-44f8-9124-9ee007613f08", "sighting_of_ref": "indicator--d770bb4b-1430-42c6-a909-554ce63ce2bd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57e52e9-63a3-4094-b8fd-ad594555a27f", "sighting_of_ref": "indicator--da4cd951-1287-4778-9191-b733997451d1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5a1d385-f552-4ba5-9e23-2fdce0fc0e1e", "sighting_of_ref": "indicator--5f173d6a-d67d-492f-878c-32004258bdc8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--079fa698-0d96-4750-b5cf-1b2f1b1f147b", "sighting_of_ref": "indicator--624a527c-0cd1-48c5-94d6-1010e39eb60f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b4bf979-fbd1-4137-bd4d-ea6bd5d3a64a", "sighting_of_ref": "indicator--a90732dd-db3a-425b-998b-40464102042a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3297c9e-504a-4969-86aa-8d1510bfd6bb", "sighting_of_ref": "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3335401-1949-49ce-96ef-7969e10b94c5", "sighting_of_ref": "indicator--7a6c3c07-4632-43ca-9f81-6c41919737de", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a3a0e26-bfbe-419c-bb0b-4103908e31ce", "sighting_of_ref": "indicator--1147aa07-6626-4658-8a6a-889f5d31e9a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b402e881-daf5-466f-97ff-703e0e6a8146", "sighting_of_ref": "indicator--737d9ed0-4b35-48c5-8b3d-6e143ca2c266", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d5aa0dc-3c23-4ff8-8829-686eaa604ebe", "sighting_of_ref": "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d55c1b0-88fe-404f-8ff1-fea99a934c26", "sighting_of_ref": "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a420627-759e-49ae-bdb8-b9a9eb782893", "sighting_of_ref": "indicator--dc1d888d-77fd-4891-a10f-f5e48a3b4976", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b8d072-458e-4680-86cf-08cd69f1c05d", "sighting_of_ref": "indicator--bdfa5093-4c50-4483-92c6-3d23db1a3284", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fedcd4a-a249-4692-8cfd-d6d85af94bf6", "sighting_of_ref": "indicator--618432ea-2137-4fe1-9e53-fbef2a5baa18", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a355ce4-1347-4de1-aac9-64faf3efbc74", "sighting_of_ref": "indicator--0336cf7a-7c81-4b21-9e4a-dc1886ddaa45", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--64585cb6-cd79-4dae-81c4-7ce6d3f3a91a", "sighting_of_ref": "indicator--6f10cf7f-bd46-4de4-a35f-589b3b88e458", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a65ea12-e31f-459b-addb-122907afb85d", "sighting_of_ref": "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b58b7594-37c8-4650-814b-5587d579bd17", "sighting_of_ref": "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc4dc4be-8003-4398-b696-0c232533aea4", "sighting_of_ref": "indicator--9dbb6396-cecb-44f5-9389-3df5dc182d49", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee2edc7-d81c-4bd2-80c1-1657fa2f591a", "sighting_of_ref": "indicator--5e98863e-604e-4d91-8366-fb6a39d66c2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ddb64540-590b-4410-b56c-305c2cb31576", "sighting_of_ref": "indicator--df3f04cb-b2c1-4c59-ab74-4e2ff5547819", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfae7b77-524a-4d27-a034-cfef14811d3d", "sighting_of_ref": "indicator--cd604ccd-bb03-4cf9-9b91-5c833e57d7b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d28356d3-5fea-457a-86c2-134fc01118a3", "sighting_of_ref": "indicator--6076f79f-516a-4e9b-ae63-0684c92eeef3", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ba59e90-959e-4a80-b48b-5090c14bc824", "sighting_of_ref": "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320453e6-8628-4cd5-890c-5611e5acbdff", "sighting_of_ref": "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acdd6e81-3a58-4021-910d-d986adc52c1b", "sighting_of_ref": "indicator--c864f726-11de-4237-83a1-5870ac8c95bc", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dbbabf6-276d-43ab-99b4-99d913126bd1", "sighting_of_ref": "indicator--800a5379-bd37-4186-938a-edb91c80134e", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0faec4c9-d32c-43f5-ba0b-839373d4cbc9", "sighting_of_ref": "indicator--ae26ef94-c75d-4618-b86a-b8be2609640c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8e4f8dc-cc82-4c20-8cd2-c396a6b65420", "sighting_of_ref": "indicator--38cceeed-f9a3-4142-9870-d60a69f466c7", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a099511c-3936-4cb4-837e-66173845fd2b", "sighting_of_ref": "indicator--2b9bf0df-8706-41c9-8aba-eb9dc73af8b3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b291d5d9-87d7-4e6c-a257-feecb6fabce1", "sighting_of_ref": "indicator--ec3150bb-30f8-4daa-8a52-e8a93613e925", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f94fa586-2281-43eb-bbb4-5d451adad580", "sighting_of_ref": "indicator--7dcd4594-4cf7-4261-a6dc-1fb530e97820", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--331ced64-1fc2-469f-a074-b31917f2df7e", "sighting_of_ref": "indicator--dcf12ded-93b6-4bd2-bd60-a60d9de2346c", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb1438b3-fb97-48ba-82d6-7067f05c7817", "sighting_of_ref": "indicator--00c03ab5-d4dc-49bf-8580-afc79090e711", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d00d5d6-2a0f-4e53-8a56-5b5619a44ca6", "sighting_of_ref": "indicator--d1710110-6a9e-4427-8a28-e8246647c53f", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9064363e-a0b7-48cc-91c6-0b995b9cbc29", "sighting_of_ref": "indicator--a8e0ed95-cea1-4d48-b2ed-4abbefebd7e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea20b34a-83a4-49a7-9474-667ad557c04d", "sighting_of_ref": "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47d6a837-31c2-465e-aece-88d058132eb7", "sighting_of_ref": "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e53e881-f41d-455a-b32f-ad7acf1dafc5", "sighting_of_ref": "indicator--cb5dd83c-7069-483b-ac14-8a76294bb59f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb68dac7-1572-49d4-93fa-4ff093386085", "sighting_of_ref": "indicator--9e78f342-7799-4922-a5f0-56a7bd86c7af", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8e0ab24-350e-4d88-aeae-d9a086e825d8", "sighting_of_ref": "indicator--7cb15031-2490-4a8f-a133-16724979b187", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94f6f306-d447-45e9-be3a-929f409186b4", "sighting_of_ref": "indicator--44bb4fc3-4720-4fa6-9b7e-a9e85977216a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5df8425e-6da7-45a7-a2f1-3b1694b7f354", "sighting_of_ref": "indicator--3298ac35-5ca2-49fb-ab6c-b7e69112ff18", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d908b8b1-dcda-4c1f-987a-889fa5b54ff6", "sighting_of_ref": "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f76494a4-0058-46a8-8afa-87567cf4ca91", "sighting_of_ref": "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--110b3ae4-4d32-4995-9e93-73651a70f142", "sighting_of_ref": "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f21cf7f5-0abe-468e-9035-86ba3e03b056", "sighting_of_ref": "indicator--54d21dbb-20a1-4ae6-90c6-d55107ab685a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5d8cddc-b584-4e5a-b169-e145bf956d2d", "sighting_of_ref": "indicator--ad6ad65a-a219-4c9b-a526-03c0d6dff073", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71b06727-bf8a-45bc-a00d-28b0b457bf61", "sighting_of_ref": "indicator--713533b0-2a0d-4ed2-92d0-9e51777b12f1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf50caf-8e06-456e-844d-d234b97999ae", "sighting_of_ref": "indicator--06b84e7d-565e-40f4-845d-ed5614b52ed7", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0f25486-83bf-4763-9b97-975949a1c7d1", "sighting_of_ref": "indicator--662ad891-fb31-4078-813b-ebef6489396d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40a36de8-2a2d-40b1-9545-f1a4620fbcac", "sighting_of_ref": "indicator--6c97393e-8c8e-4ff9-943d-99c37674d084", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18db9f73-c915-4e00-95af-fb8d1f5a1bc4", "sighting_of_ref": "indicator--f43a480b-c3dd-4515-b8da-7da61c69c056", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036ff553-e378-453b-81d2-78faf50d0581", "sighting_of_ref": "indicator--d59db5e0-9e6d-48c6-8aba-4469bbbc1f15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e62e54de-f550-4d72-95e7-e5c4f1d95965", "sighting_of_ref": "indicator--809db237-c173-4514-81f5-ea997ca303dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75d8caf1-791d-40e4-b162-ac574e19df88", "sighting_of_ref": "indicator--c9968fbb-ce76-4316-ac24-29cf31b69c39", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96523db7-5f51-4305-8904-39e4d430ba80", "sighting_of_ref": "indicator--cbc09f58-86f4-4998-8d68-c02e4ee80928", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4177a441-c38c-4457-aa6e-34c7029595f8", "sighting_of_ref": "indicator--bbe62e76-985d-4c15-b70e-1b67d4e79507", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b832373f-96f7-4a39-9704-d08a6e16deee", "sighting_of_ref": "indicator--15c6f294-3a2b-4e5c-8946-4ed1860d74b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--538d5810-2d10-4ddb-bead-e72cf2e2826c", "sighting_of_ref": "indicator--0457413e-b94f-4e28-852d-f999de4d5135", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--447ad0b4-6846-42f6-9fba-061bfc7b64ad", "sighting_of_ref": "indicator--4bec4f9f-be23-44fe-bcc0-c76968a7720d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18272b54-2171-471b-8f32-af89639e168a", "sighting_of_ref": "indicator--7e889f01-7b44-4232-a943-00a7fd7050e1", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e12b9c75-ab36-42ee-b3e7-c9e1258f03db", "sighting_of_ref": "indicator--b5f49dd8-0638-4fc8-a221-864d40919e0e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fa22a0c-8db1-42ba-9002-dfb67c4ff360", "sighting_of_ref": "indicator--1813845b-d1f1-4e2a-8208-519d4e3908ab", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfd6be93-255d-4e3c-a7a5-b37f2b959da5", "sighting_of_ref": "indicator--f97057c7-7a7a-49d0-bef1-2fd5181e878b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96c5d58b-44dc-4a75-b678-8fef4abfaea5", "sighting_of_ref": "indicator--0f1ae6c4-f336-41fa-b55b-0521df9d1125", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667c0d29-9fa2-4061-a2bd-fda501c1ab2d", "sighting_of_ref": "indicator--e19ca9c2-1965-4331-ac7b-5e553180bf62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad53c344-b157-47fe-959f-65417aba42ea", "sighting_of_ref": "indicator--abe07724-eb9a-4490-bf05-3ea9aad4389a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93bb1e61-4f7f-46e3-b4f2-1e70b4e83fbe", "sighting_of_ref": "indicator--507bcd4b-451d-4059-bae3-79eebf940fea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0cbc5d2-c2a9-44f7-b498-ea01faef20fd", "sighting_of_ref": "indicator--b444f0b3-8cb0-41cc-bc64-11d4db376d6c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27124b75-c687-4611-a159-fc77de08bdf0", "sighting_of_ref": "indicator--1521f72b-0871-4123-97ae-082f9dc75b78", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e622810f-3db0-430f-8004-d77612b704fe", "sighting_of_ref": "indicator--ca207c6f-d3e2-4ffe-afec-123441b21d7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8871e3d3-2992-4362-9003-b1ac43c111d4", "sighting_of_ref": "indicator--7db57034-5c37-4aa0-ad0f-eb49558ca155", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c7ce3dd-c9ba-46d7-9163-454bfd7e9b79", "sighting_of_ref": "indicator--d0a29bd0-fd03-45e0-9c4f-c9b60b53d81b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dd78f43-0669-4861-a6d5-aec6694ed39f", "sighting_of_ref": "indicator--9554d10d-9939-4c72-9aa5-fda296bde6f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6e1abe-89be-4440-86dd-447d562e0ad0", "sighting_of_ref": "indicator--d2d43d13-d1bd-4607-aaeb-62b43aa17700", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63608b7c-d0c6-422a-b094-91861ad0356a", "sighting_of_ref": "indicator--625825bb-c852-4468-92c8-2c42b2132df3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b93de2b4-693e-42e0-8e60-7ccbd89fc1ff", "sighting_of_ref": "indicator--c87175e7-384c-48e4-a78f-0c629cd2a4f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e33ddf2-33cb-475e-a371-c8384bc9e85f", "sighting_of_ref": "indicator--0bff41eb-cc79-4f7d-925b-8b4eee87c992", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--162a298f-ee83-404d-91ab-16aa70fc6a16", "sighting_of_ref": "indicator--950090fb-be00-40a8-b93f-85a600213571", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7432e469-1015-4128-a18f-ceae23a74759", "sighting_of_ref": "indicator--a07bfc23-b936-4365-ae84-e66eac2c893c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9265b50-e464-4222-a0f0-8a7539d6c3f0", "sighting_of_ref": "indicator--291d13bf-932e-4c29-99b2-31652077c3ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaa43fb7-8da8-441e-9e06-67ab3668024a", "sighting_of_ref": "indicator--04824ef0-1ca4-4fc0-9f50-92b96939cb10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f352b53-058c-45a1-8cb5-fec976562891", "sighting_of_ref": "indicator--7d6fed61-b45e-43a0-977a-fa52e7b2e9aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d57975c8-276e-4c37-8d59-416867ebdc77", "sighting_of_ref": "indicator--1c836827-cb29-415f-9fb5-145f13267f3f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e23bf98-1e4c-4f67-8dbb-6ad050c71c38", "sighting_of_ref": "indicator--dde5a092-a020-432f-a845-000985bc2608", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29a569d7-589c-4c53-884c-7ba2936a1b32", "sighting_of_ref": "indicator--1eb1309f-ab37-4bc5-bbf8-2b5736fbc026", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb9ecadf-bf84-4f94-a0b1-38cf0b8fe636", "sighting_of_ref": "indicator--8de2c4bc-ab5d-4ea0-af1a-8e233cd05cae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b86ef5dc-1b69-4b93-af74-22bd5f57b247", "sighting_of_ref": "indicator--84443e5f-92ba-43f0-b472-55ebb50f25ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbcd2478-0130-4141-970c-f79b9660dad2", "sighting_of_ref": "indicator--2d2f5fb3-7cb2-4bda-847e-12b04520bda8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d94ae96-f076-4590-9bb1-a8fcb16988fc", "sighting_of_ref": "indicator--6e8ac16f-89f9-42c4-9539-48c83f336530", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--296fcc45-403b-47e9-8d34-8d8f5a93c35f", "sighting_of_ref": "indicator--d47757ba-bf6c-4ecb-81c4-638454013bff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b795158b-6626-4d16-a6f1-b574838eae37", "sighting_of_ref": "indicator--0bebe372-2946-46de-b595-60ed4aeeb063", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31b4f7a8-c594-42e3-a648-2d2d9170fec2", "sighting_of_ref": "indicator--cfd60f0d-cc27-4402-ad7c-6626dd04c16e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cdf5552-03a2-48ba-876f-f197dd9752b0", "sighting_of_ref": "indicator--a6051165-bf7a-4fc2-9713-ef40a765dc8c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92b5d65e-230f-42cb-bf4a-4f79087bff50", "sighting_of_ref": "indicator--e6483919-f6a9-464b-b431-283b7919ba76", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d602645-b730-4371-b769-1ca6076d639f", "sighting_of_ref": "indicator--04c52b36-4b69-4f33-9f40-0a6b1f00785b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d92a0922-2ac6-4a4f-be5a-d28a5b231e8e", "sighting_of_ref": "indicator--0629bcfc-7b33-46a6-9e94-f1ae1e633924", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--355b66b5-918a-47e2-b875-45a4c6299548", "sighting_of_ref": "indicator--248ec13f-27e8-4ea4-9a7b-d07549ce007c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8a9ba76-6fdb-4b29-98cd-008bc0e52262", "sighting_of_ref": "indicator--3c4b0023-73df-4c9c-838c-82e2e7c02aee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d67d273-c868-4045-a15d-e92f2b5d40d2", "sighting_of_ref": "indicator--fa4d7740-d58a-4745-a0c3-f7ea6f58ffbf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1647dadb-2dae-4931-a6ec-5a1b756090d7", "sighting_of_ref": "indicator--83d62693-8b9d-47d8-bc08-a2838e94be08", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5fcfa38-5245-4f4b-afc5-7091cbb95d77", "sighting_of_ref": "indicator--f8e9a2bb-6505-4123-98d8-d26691c13ad7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7006a21c-6585-41ec-a9cc-32dde97093f8", "sighting_of_ref": "indicator--2eb72400-e3cc-43dc-8035-748fdd91f8e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--517b52f6-1dd1-4577-a844-8fffa64b96de", "sighting_of_ref": "indicator--0966484d-878c-4074-9750-fce41172a896", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77171722-94b6-4c35-9d00-1772f856b69b", "sighting_of_ref": "indicator--fa05a118-e2ba-4055-8c1f-76cc087ac623", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--091cf932-8d88-401d-9a84-f9079f241d68", "sighting_of_ref": "indicator--28d9c83c-cdaa-4842-af6c-8e457798868b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c54eadc4-293d-4d78-ad86-4da3007e5f12", "sighting_of_ref": "indicator--3939bc3c-3386-4608-9f7e-467af5c15ded", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f9143de-0c9f-451d-830c-bc0e8d9ecff4", "sighting_of_ref": "indicator--5f2821e2-2f3e-4fab-a152-f1bb882fc976", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9126d02-47c6-48f5-af3b-700eaa9886ad", "sighting_of_ref": "indicator--25d5ba0a-74d2-44df-bfa5-91219a6b2a3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--898ba671-7423-4881-ac53-ebeed4672938", "sighting_of_ref": "indicator--6371ee57-21b6-4822-8f7f-ceaf6fab9188", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--650c99d7-d20e-4758-b458-60f0e8e16f3e", "sighting_of_ref": "indicator--9a0230a6-cab4-4a03-af1c-8e57352fae31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27956aa0-f2ab-4e15-8cac-be118d1ff813", "sighting_of_ref": "indicator--98701eb2-eb68-48f0-8425-43009f0f1a4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c26d4036-2f5c-4f07-995c-f5563ccfd905", "sighting_of_ref": "indicator--fa0fbd07-eadf-4ea3-9def-355951ba292e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--796a732a-a2df-4ef4-94a3-aa68016bdf6f", "sighting_of_ref": "indicator--172dcaa5-a53e-46c0-8aa6-c6108a683553", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba141d3f-a479-456f-be42-05014a0926c7", "sighting_of_ref": "indicator--d5ae0421-f746-4aa9-8687-7edc3cf5247a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83ee8542-1f50-4dd1-a1b9-064b3d6d72b8", "sighting_of_ref": "indicator--b8fe7795-ff65-4f0c-8be3-d041fe18f51f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dab48213-669e-4cec-a125-77983552cdcb", "sighting_of_ref": "indicator--dec0bd7e-18ea-45ff-a242-d3ca5c4a0997", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78bca241-d339-45c6-b720-33643e557812", "sighting_of_ref": "indicator--ff33bc89-3c9e-4077-b237-8df4cfcfdcf7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bde08cbb-d70b-42aa-b0a5-43a1d2288754", "sighting_of_ref": "indicator--a3960298-5a93-4c43-a6f6-79a65843caf8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a049a431-e9be-4a1d-b344-ea62f1c42497", "sighting_of_ref": "indicator--6907cd88-8c10-4a69-bfe4-7f20f264af4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f572133-34f7-466e-b51a-d81acc418e70", "sighting_of_ref": "indicator--7a1cbcec-21da-4821-926f-6c5b5f109951", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e573b2f-f0cc-41d3-a009-883054e3b499", "sighting_of_ref": "indicator--53ffad11-ba61-40e8-a09a-41cad1cc677d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d164ba0f-c989-4769-b450-93e8f8e45192", "sighting_of_ref": "indicator--31d7eb82-0656-4763-955c-56f252f7acb7", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1834871f-dd54-4351-b4d3-c46d67f46570", "sighting_of_ref": "indicator--2c544ef0-84dd-4344-a80c-b35107febd27", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffe7e733-44a8-419a-aacc-9842ef80b4e3", "sighting_of_ref": "indicator--6e2a0f85-1081-4f1c-906c-ad545e0dd486", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c450aaab-7521-4d3d-b222-b7570d8d8661", "sighting_of_ref": "indicator--5fda814f-8046-4ee2-8d2f-c41484febabc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74766f0-157a-4d8e-ad90-fed29c81d2cc", "sighting_of_ref": "indicator--30cb9cee-7851-4a33-b51b-156acc6566da", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fc48e0a-6449-49eb-affe-e787074d7fd0", "sighting_of_ref": "indicator--5c51a677-e834-4166-ad76-847934900709", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8139a1a6-ac82-4b50-8e31-57d5586de8ba", "sighting_of_ref": "indicator--3cb36e4a-b63e-4c7d-aa67-e6009de4fb11", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1e71c6d-fb2a-4562-9f30-8e470df47b77", "sighting_of_ref": "indicator--ac1652a7-9037-4f71-80a2-1b948af0b30b", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bb214d8-4fc3-4915-89b7-1a50747cb9f0", "sighting_of_ref": "indicator--8631be58-8110-4a54-bab5-c58eec2746e9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--798d9572-089f-48cd-a4f5-24890808c3b1", "sighting_of_ref": "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e596e70e-0f72-4c93-a1e8-3d464207f16b", "sighting_of_ref": "indicator--a8a9c0dd-145b-4831-9de9-1476ee71da83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39f68baa-3740-4c22-8058-a15c2ea706d1", "sighting_of_ref": "indicator--0e2f8f29-ba4a-4a5b-8a28-305414d37edc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a6f641f-153d-4c94-90d3-53ad7f0dacce", "sighting_of_ref": "indicator--d7991fe5-1cf7-417b-a181-693363e59c5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f80905-123d-4ee0-9b21-835af635965d", "sighting_of_ref": "indicator--d9558f4f-16f1-4ca8-86c0-080504ef4665", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--caeb1fdc-329f-44ea-ae64-8bead28b38d8", "sighting_of_ref": "indicator--6745062c-15d2-4994-9576-6a0272dbc74b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3323caee-75e5-4417-bd1a-65c4071e603a", "sighting_of_ref": "indicator--a06994d3-6471-4ca3-9216-67a89a53fc58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32601d74-c553-4b7a-a74f-2e5d3a653fc2", "sighting_of_ref": "indicator--66958272-965b-4cf0-93ac-7a6dd1d398f8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13ad9ff8-ef55-46ba-bdb9-fc62a2d582d1", "sighting_of_ref": "indicator--6035f184-d327-4731-b840-7576782d2eb5", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--064c9ff6-8be2-4b2c-abef-cdc0422fce5e", "sighting_of_ref": "indicator--f363b887-923e-482e-bf4b-d9941bb83776", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b33e6ac-f2f9-4788-9d5b-38e9e80beab8", "sighting_of_ref": "indicator--4bf84035-c24b-47ef-bd6e-32956b683275", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbedce4f-b228-49c1-a837-68b14232bda0", "sighting_of_ref": "indicator--bdca2a66-e77e-4437-ba0c-4e4a9219bc41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1a85eb0-b87c-49c0-805e-9fae7e30b626", "sighting_of_ref": "indicator--beda0b8c-2ee1-473e-be4b-17a9f9bbc7db", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9385d1dc-f9f9-4637-b3c0-5268442e5c71", "sighting_of_ref": "indicator--481ca6db-d4e8-446d-81fa-eb0179f409c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ef91192-25ab-46a7-9fa5-8eb19f5a0cd1", "sighting_of_ref": "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5fb129e9-1a86-4b61-9578-e376665e4d91", "sighting_of_ref": "indicator--6514c7d2-4728-4b4d-8750-9002fc0d459b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e231d6a2-2888-4d25-b053-b681082990d9", "sighting_of_ref": "indicator--443f97a6-9635-477c-8d18-02cee3b3a7ce", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a60cd81-7b0c-468f-8bce-82c9c595191b", "sighting_of_ref": "indicator--56dd400c-2acc-4b23-a091-0dc3af5cf057", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b13325-03af-4eab-ae03-401e65357a74", "sighting_of_ref": "indicator--10d04500-7257-47b5-843e-602f4f038a0a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff57fef3-1914-40ab-ab31-13fc807f6bf4", "sighting_of_ref": "indicator--9a87cc60-dd5d-40d7-813c-e893c2dace9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--084df6dc-b481-4da0-8891-dd22edabe120", "sighting_of_ref": "indicator--cbfc63cc-583e-4eba-ad23-aca5d23ddaa2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--581d5b6e-f1bf-4773-ae26-9642c339b97d", "sighting_of_ref": "indicator--a1e3b1c2-c79f-4e2b-a1a2-b7126b91b53b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e4b775c-b2d7-424a-a8e5-b3f61a20fb35", "sighting_of_ref": "indicator--240a45b9-727e-4e33-89e3-92d40b6a0b9a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbf6b707-da3f-4ed6-8384-b7bf3fe85e58", "sighting_of_ref": "indicator--de1dfdfe-d8a5-4acf-a29a-7342b176add7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f95925-2413-497f-ab1c-b1388fefe21b", "sighting_of_ref": "indicator--1f646238-4513-4d79-a328-acb742f84cc1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d4d2a3e-0461-4873-b757-5807c9b445c2", "sighting_of_ref": "indicator--96df7a30-2c4a-4f0d-8543-274566e6fb23", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd5f8d95-4060-4c82-9db5-4ee2ffef3976", "sighting_of_ref": "indicator--f38f5c71-a992-4c67-b29d-b7dc3b3023e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b958c432-3166-47c3-b3cd-11134a7206d4", "sighting_of_ref": "indicator--24617e1f-cda2-46d2-9c0a-1fd5ed6c2ed7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c09aa3d8-c2a6-4f30-9e7f-e35e211b15cc", "sighting_of_ref": "indicator--3cab08e8-327e-4393-895f-671cd37d2d40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d87aa76-38e6-476e-98e8-a32668243ae9", "sighting_of_ref": "indicator--6dd1a83d-7e32-4ebd-b320-b1079d998ed7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81880a5f-d52b-4997-ab6d-c5e7788d1d14", "sighting_of_ref": "indicator--fa6cbe2e-61b7-4b31-b5b9-6ae7888b8855", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--270e26ad-356e-49a7-8ad6-6fc0b4d6ed24", "sighting_of_ref": "indicator--c22dcd6b-3221-4a42-908f-a543e19b7fdb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446927b6-d16d-4035-a6fc-6ea9a4ad9785", "sighting_of_ref": "indicator--5e6651e0-3c2e-490b-b74e-1dcf2bb2bfa9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61f1e8f9-54a6-4894-9b07-e7797bd99504", "sighting_of_ref": "indicator--600c110e-7b47-4ebe-a619-7ab66b59d963", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6608ff5f-1450-433a-add9-1b21f4c2b938", "sighting_of_ref": "indicator--d88a7990-c8e4-4019-9456-1b78a50e1975", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a618cdef-7803-4c78-9862-45c0c4441e6a", "sighting_of_ref": "indicator--4edc68ca-6c0f-4ab2-8c89-6e0691d87411", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3caff918-c8ea-4960-83e0-985b3ec31fc0", "sighting_of_ref": "indicator--00c96615-da60-4172-a75c-6b123840a532", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5022f007-f1b9-4066-bb3c-f87e47b18820", "sighting_of_ref": "indicator--c7e93db8-010b-46a2-86a6-195b9fc4a487", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8075a0f-c727-4d0c-a814-f5028ae0c30c", "sighting_of_ref": "indicator--e981895f-f088-4a49-85be-6109f4e9a365", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5bfdfba-4ba0-4581-bc22-9bfb4a3f7d36", "sighting_of_ref": "indicator--126bbaad-5254-400c-85af-68a85b15b41f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7e6adba-e7b9-4bd3-aaaa-3c512e98ebb3", "sighting_of_ref": "indicator--c5ac0dd6-1822-4dac-a9e1-4c2bdf0f670e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06af581f-8b41-464d-a698-15d1100e7ba3", "sighting_of_ref": "indicator--936514f4-7de1-434a-8dd1-043ae4ea6cdc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--463b32df-675b-4506-a472-7b450ffd69b9", "sighting_of_ref": "indicator--1d7557ec-5d62-4075-a15c-12c806aec621", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14a00ee7-4177-4954-8f65-b082629d4b0a", "sighting_of_ref": "indicator--303d9a71-359c-4c52-9d49-fcfeab1f832d", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac2df204-4f55-4554-97b3-0f7781885c13", "sighting_of_ref": "indicator--8355af5a-bb81-470f-afc2-7e796b8bba09", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cdfc9972-e46a-40b8-ab4d-c9f8e052fcf0", "sighting_of_ref": "indicator--549a2b40-a770-49d8-845a-4e85cbd8971d", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96e9a670-ed46-4282-a2f8-e039a69e2650", "sighting_of_ref": "indicator--ad2e37d2-d1ca-4203-92ca-50d0eeefc255", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c59f40e-9b2c-46b4-a851-c36836455a3f", "sighting_of_ref": "indicator--ec3a638e-0781-435f-b862-d5da310c9a6c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d93f5b95-5ad1-4b2b-9f1e-33074a4ba669", "sighting_of_ref": "indicator--8973c72a-987c-4298-9a90-794f069cc101", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--633cff1f-6ef6-4e7e-a190-bb3176802244", "sighting_of_ref": "indicator--c4f24989-fd1f-43d8-b6a7-a744c5c82f5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--975d44c0-16e2-4160-a7dd-534c96b2ef02", "sighting_of_ref": "indicator--a01c7556-7ea2-4b6c-920a-701eff2bfea2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8b09888-504d-4793-9299-8187a7ce6d46", "sighting_of_ref": "indicator--43460615-245e-49e4-903a-71192c5b778d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a096c827-613f-4b0b-bff6-c5e0655f0186", "sighting_of_ref": "indicator--71f8ec98-ee56-47f0-89ae-01600fcc49f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a3a2805-a9f1-4139-93b5-06d40a36171d", "sighting_of_ref": "indicator--3f18a322-7c1a-4058-832f-2c5734f46af2", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169213a9-a66c-4725-a906-5801d7e77bf8", "sighting_of_ref": "indicator--3f18a322-7c1a-4058-832f-2c5734f46af2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9eed2bc5-77c2-45e6-adad-1ad89bfcb51a", "sighting_of_ref": "indicator--9e9d42c9-ad92-4203-a396-54432996a76c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1cb0e8c8-e0eb-44af-90c8-c9f5bb67fc85", "sighting_of_ref": "indicator--fb659d5a-445e-4e44-9571-3c56519da0da", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bc6f166-4cee-4016-93e8-ba25153a2bfa", "sighting_of_ref": "indicator--18d45d48-3947-46ae-831c-ff0e2c8a0bb5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e212833-6885-40c8-b64b-69da7afb24cd", "sighting_of_ref": "indicator--7c45ee5d-b5db-46e2-9879-1eee9b6d9d35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1275c353-103b-4d6f-8ff6-cd323c2436ea", "sighting_of_ref": "indicator--fad0b0a8-6bbf-4cd1-a957-2159309a638b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fb0ded8-ddf5-414c-8132-52c7a438b54a", "sighting_of_ref": "indicator--b3d836b5-25a8-4c68-90ad-669a469c1586", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd8e718-21cb-45c1-8804-aeade6dd6914", "sighting_of_ref": "indicator--6a0259c5-816f-4aa6-a2f6-3673ea3243f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--199625c3-90f7-4833-aa78-f360ddf5ce4b", "sighting_of_ref": "indicator--c4cecc52-c560-473d-b346-9c5585060024", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9353bb54-c452-4bd8-8573-8124d434c02c", "sighting_of_ref": "indicator--736ce219-a83a-4f70-b67d-7279c7d5e04c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbdaf8ac-9cd9-4f32-bc55-907369e948b9", "sighting_of_ref": "indicator--5382f53b-f385-45cf-9f3d-8d4e66acf299", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a48e14-c7ea-41b9-a72c-9871621d4e80", "sighting_of_ref": "indicator--7a2a2d8d-a0a8-43cf-84da-a94dac250ba6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c3fd0147-d34f-4aba-a5a7-9afc346b5338", "sighting_of_ref": "indicator--4ed3200f-2348-4ed2-8033-92907d4359ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2d2aa80-2fa6-45a9-8d3c-6eb1c5350887", "sighting_of_ref": "indicator--6bd0faa5-3f1b-4d1d-b199-a9b3641b81c0", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc05506d-39fe-468c-b520-95f6a83e0e9e", "sighting_of_ref": "indicator--a4f14281-a2b1-4344-8edc-056d03321560", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f39f2bfb-9ca4-4c37-9f4b-df4b881c9a3d", "sighting_of_ref": "indicator--54bd5eda-32b3-4f31-b131-497e6cd7ee5b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cd5d1d4-6ce1-466b-8339-0bc83ac5fea5", "sighting_of_ref": "indicator--9c787f0b-cc9f-4247-b65d-0162bf00fdeb", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c32269-5045-459b-806c-c83c7de4c0ee", "sighting_of_ref": "indicator--8cf6044f-0d93-4fe5-af40-5f1f6a865c4f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d06979b6-5d9f-4409-9c0f-815c21f4255a", "sighting_of_ref": "indicator--f14a46c8-fd73-4558-af37-1707414b0f4d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a1267b5-09d5-40a4-9afd-83a3711121a8", "sighting_of_ref": "indicator--f6515007-2f7d-4bf9-9c02-679cbe4c378f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e299484-284f-4e58-b6b1-7ef7c5016b92", "sighting_of_ref": "indicator--a5b6b19c-f307-415f-81c8-3e865582d51e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70f4327b-a2ea-4d51-9c6f-5925fc03dd85", "sighting_of_ref": "indicator--4008649c-698c-46ba-a059-46a1882cbb72", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d99d306-9810-45d2-bcb6-e90922244948", "sighting_of_ref": "indicator--46bb7705-709a-4b4a-a000-2f4d228efb23", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11efaec8-c43c-49cd-935f-a027d918c7c5", "sighting_of_ref": "indicator--902aa625-76f7-41ed-8f23-53c5498ffc76", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d747f1af-a779-4a84-9022-99676fe43f85", "sighting_of_ref": "indicator--17effbbe-5451-4b90-a637-39fe40e26f51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c09979e7-2214-4df3-964b-f6abbed0b71b", "sighting_of_ref": "indicator--70d328a8-0898-44a0-9a74-f919571856b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adbc8ee0-b086-478a-9030-11256e6d8083", "sighting_of_ref": "indicator--63ae64f7-f346-4cb8-b354-3b2d6f4d9e1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--460a2c47-974c-4849-a67b-e88df28733a9", "sighting_of_ref": "indicator--ec14b4a0-833b-40d3-90b5-2ab7c696fe43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e211f5c7-850d-43f2-bd0b-8ef901c0c6ce", "sighting_of_ref": "indicator--e9b3064a-a2e5-4b72-8b73-d525efce2c0f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc236dd3-b012-46d4-8f6e-72da5c102847", "sighting_of_ref": "indicator--7dd72e1e-925b-414b-ae12-51a11743c0e9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ec2fd54-80d4-493b-877e-dae35c81c615", "sighting_of_ref": "indicator--abf5fa83-5562-46bf-80c1-76796554cc5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06d338b3-11ac-418e-ae46-a646c55efc81", "sighting_of_ref": "indicator--f444dc2e-c446-4136-b16e-da4746fea35b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecf98220-36c5-46f5-a153-1cb32e35d935", "sighting_of_ref": "indicator--2ea5503b-3dcf-4346-9c39-5b2421553902", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cbfd373-5ca3-4ad6-9133-33604037d97e", "sighting_of_ref": "indicator--27913063-3b9d-4a12-9bcc-596ffe974198", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58e67eec-5048-4ae8-be00-6f3040d54ecd", "sighting_of_ref": "indicator--b7e6f8ea-81f1-484d-ba6c-6079d70e3c2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04fbab03-470e-4011-981f-8786ebcd9263", "sighting_of_ref": "indicator--b71a2930-b85a-4872-b58a-75afb383b976", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b82554d-d39a-4dcb-b425-df0775265f5b", "sighting_of_ref": "indicator--9309a27b-012d-40cf-a25c-4fbdc51a359f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf9cb227-dfe6-404a-9765-9606d70c07d3", "sighting_of_ref": "indicator--edd4f252-edc5-4586-b62c-1164f714fff4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--061b0386-fcd6-47b4-ab27-1968878100f6", "sighting_of_ref": "indicator--ce72a666-ba0b-453f-a949-bd9836f2131f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1dbeee2-8cae-4f06-8109-bdf380a52b0c", "sighting_of_ref": "indicator--0e128cda-9d3f-4323-9a75-d2978864c396", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1933f90d-a4b2-44f9-8af8-59ae2a6c2ac9", "sighting_of_ref": "indicator--d5c500a4-e565-4943-aabd-e2c8d0adf0d1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ee00494-4c5a-4ddd-a4a5-8ee774bd940c", "sighting_of_ref": "indicator--5c0889d0-2e77-4227-b51e-e5a92e0d2ab4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c76f90e3-0afa-4fed-94ff-b716da21c74c", "sighting_of_ref": "indicator--722e4dab-cb5d-4000-8acb-25d9351b2127", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--622d23ef-2068-4eb6-98d7-a63f9c2ce0cc", "sighting_of_ref": "indicator--e1af9326-66df-4c3b-b91b-9703268f6d6c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cddcc49e-98e3-430b-80f9-eaee06aaf04e", "sighting_of_ref": "indicator--960ac4d5-1327-4efc-8905-1ba9e285fdae", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a289a46c-21ed-4323-ae42-39338a5491da", "sighting_of_ref": "indicator--d1fa120d-5cce-4641-95a6-8d07ff9f63dc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6701f89-1303-4df7-8d29-379ad2c0c234", "sighting_of_ref": "indicator--6bef82b4-a8c1-4120-b2dd-e4fae5c146ec", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2d94de-838c-486a-8ca3-5f049d4115d4", "sighting_of_ref": "indicator--5b564937-22d3-4941-9a19-cdcc15963a5a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--002be9ba-2068-4bf3-a3a9-c8e72844ab65", "sighting_of_ref": "indicator--734bbc56-34d8-4f73-a1d8-8d925875b3d9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49cd1417-1c5c-427b-ba68-10ffa41d01bd", "sighting_of_ref": "indicator--587be777-de04-4452-9c0f-03131f0f45bc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26bd87d2-dbb4-4582-8499-4329d408f2c7", "sighting_of_ref": "indicator--a74d5828-001d-4fa9-a168-5f4ae39fd3ca", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff661647-bb4a-4364-8bc5-10c7dab1a07c", "sighting_of_ref": "indicator--aac18d73-4b59-4b52-9470-3f361b23ee58", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d0c46c4-2a3d-4996-9ab4-737dbb01bbfb", "sighting_of_ref": "indicator--e998fafd-d0fd-4e0d-a315-af101945ff3a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fe7dc4e-a1df-4c7f-9279-7021cf544f28", "sighting_of_ref": "indicator--17d8678a-9114-43f0-b3d6-a72383e5a242", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5eaab50-001a-4512-8896-db45e006ce6f", "sighting_of_ref": "indicator--9c6e896d-0c61-4d8d-8f56-885e4bd21dca", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--febb2b74-1f72-4473-8e14-93edf59f8822", "sighting_of_ref": "indicator--5313dd7c-1971-4fa2-85cb-802c5a313b0b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d3c889f-a4bd-4c5b-b41b-280e7f8fa791", "sighting_of_ref": "indicator--8207014b-edae-4bdd-94cb-4d97b4d2200f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a50d4b-8c38-4723-9b7b-9f39afb3ee74", "sighting_of_ref": "indicator--c1298424-6185-4192-8d71-ac6eb99da377", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e39ebca-3149-4e2e-b53b-99f06fb2839d", "sighting_of_ref": "indicator--a0b01d77-eaa7-44c2-80f7-509c9cab6076", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--036c8b77-c256-4a34-94d8-e7f5b9e5e7aa", "sighting_of_ref": "indicator--1c8c56c4-fcf0-4f29-bf1e-4b317d916499", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7567420-1dc6-4c74-a597-07f99e619b07", "sighting_of_ref": "indicator--c4c82b72-94fd-459e-a419-9bc067ab9c39", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3eb74fd9-8aa3-4b9e-9562-8ba6451a800a", "sighting_of_ref": "indicator--e145830b-df83-40f1-a3f5-6be75e48d91e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eb4edf4-6509-4ebf-bcf9-af8a6b03d229", "sighting_of_ref": "indicator--60db1dcc-04d4-4685-8f36-a5ac20a9af1d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--292e6654-ba0e-4d3d-b1c4-1a2a6e3472bc", "sighting_of_ref": "indicator--e276d8d0-d295-41aa-8530-f7b0ba3e1aed", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--836537a2-14c2-4589-a359-e82d4e59d2c6", "sighting_of_ref": "indicator--7dbd0efd-9ff9-4cfc-b955-0d55cd42dbe6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1709837-5fc2-44cd-9c0a-5551b78d5d4c", "sighting_of_ref": "indicator--01bcece5-25cc-4f54-99e3-eacbe8f78e05", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5051acb-3301-4069-aa85-19e5e6c12483", "sighting_of_ref": "indicator--493f3579-6cab-470b-94f9-7bcaa02aebcd", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc098a86-e204-42c6-a1f6-ae8a7b97e3f7", "sighting_of_ref": "indicator--ed40f5c2-41a1-4cf5-bd33-3efe7df612c4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acb477e9-1523-4ed4-9aca-8aaaeb1889dd", "sighting_of_ref": "indicator--e8632f3b-a75d-4857-ab8c-11c2b6fefd0f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d9d7b2-7da7-49bb-b322-8896e4d2db3d", "sighting_of_ref": "indicator--17598e4e-0651-414e-a07c-37cb5a07a58f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c45ea6fe-1432-4a36-b8f2-ef6ba4d72641", "sighting_of_ref": "indicator--42b2c18a-4618-4133-91de-d298c4aac681", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fec0f8ce-fae1-4ea2-be0d-ba7fe7457fe3", "sighting_of_ref": "indicator--a4039bce-e70a-4132-81c6-cafdcc1ca8f6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c00412bc-51ec-46b9-9bd3-207e77faf0a6", "sighting_of_ref": "indicator--663f33b9-5972-459d-96c9-f3078a0b208b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78db39db-89e3-466d-aef8-aad38c5a9f4d", "sighting_of_ref": "indicator--93ea6420-6816-4656-94ae-51f1a48e17e6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5441609-e6d4-41ad-bba8-f29ea4eb3786", "sighting_of_ref": "indicator--66e9b636-6958-4e09-81ea-efc8761ea533", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697d0dcc-613c-48af-a20c-5e559710a44b", "sighting_of_ref": "indicator--cdb745a2-5b1f-422a-9b0e-be226dd73a60", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ecb1df5-a4ba-4900-8178-9d629caa7a6b", "sighting_of_ref": "indicator--fc421d7d-ee5c-4ed4-8a79-4bea5fb98b5a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e824aa2-722a-4070-9d2d-9d7799b35680", "sighting_of_ref": "indicator--8a0480eb-4b9e-4ed4-b95d-08b05db6aeae", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0303500-2def-4703-aaa9-346d90e262c0", "sighting_of_ref": "indicator--ec4e40f5-2452-469c-971f-d920c9b36ef9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbc98594-02f7-4113-9258-9aa066426840", "sighting_of_ref": "indicator--c7dec1f8-4827-4001-83fc-87d0d3ede9b7", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b45b1e7-904f-41ac-b066-b784f0627a30", "sighting_of_ref": "indicator--e7f19adf-9c17-41b6-9613-3184dfa6d2fc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--941aca80-5cce-47ce-b9b4-ffd36df4bee0", "sighting_of_ref": "indicator--dba7cfd5-f866-472e-a3ed-7971f373b5b4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a146f75a-f392-44ee-9941-606f2f7584a3", "sighting_of_ref": "indicator--48102b12-d2c8-43d6-8fd6-a68df20b2dc5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a306bf69-cb5e-4743-b685-d185ad92ab47", "sighting_of_ref": "indicator--bc8bada5-d698-458f-a5f7-663260cd5049", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54fbfa9e-79a1-411f-b760-ee7e461422eb", "sighting_of_ref": "indicator--cc9483bf-11fd-4458-a744-e28d863686e3", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acf415eb-b0f7-4d0a-a978-83753781486e", "sighting_of_ref": "indicator--86b9e665-9b8f-42b7-977f-1906432ec747", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3db058f7-3f73-4e5e-850d-6160491d9f54", "sighting_of_ref": "indicator--4f273109-8fc5-4e74-80a1-948e3f6ae6a2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91cb323b-ec71-4421-9c94-101b54096521", "sighting_of_ref": "indicator--ad6f38ee-bafa-4476-a9cd-14b8049da61d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2e9f4e0-4036-4606-824c-193d88f767dd", "sighting_of_ref": "indicator--27a5cf16-5395-40b1-af0e-f13ad8701ca9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b768db71-9815-40c5-afc2-272d3bcf2b4d", "sighting_of_ref": "indicator--a32b7ebd-542d-45b7-b13c-74a1721d5bea", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b39c86f8-a208-4801-8386-fee3cbeb84b7", "sighting_of_ref": "indicator--ad489a80-b918-47df-a422-dc9b385e0bae", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed4ce1f3-c777-4081-84a1-7d595ba04fcc", "sighting_of_ref": "indicator--8a95d342-337a-4cbe-96db-7dd353914c25", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3428783c-4c11-45e9-b13d-e2383a42ad34", "sighting_of_ref": "indicator--6f0e40a4-377a-4ec0-bbbd-630be0a95a39", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--557a9bb7-e1bd-4a01-8f9a-a312b677c72c", "sighting_of_ref": "indicator--616a4735-8cbe-43e0-9dfc-97ae5407adb2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e15b8689-b0d8-4376-8e9f-e41240463ba5", "sighting_of_ref": "indicator--d7c491a2-f6f3-48e9-8622-cc6045c94b8d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60ab0ace-5fd9-4cca-a73f-c60be8f33b65", "sighting_of_ref": "indicator--041f0b63-0b91-4390-8837-39c06fc745f3", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--639cc80b-81b1-4740-b925-ce262568e585", "sighting_of_ref": "indicator--3e5d548e-d0ab-4f0b-8e9a-4147aeab2baa", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c715afbc-4318-4c55-a6d6-4d76da48ebb4", "sighting_of_ref": "indicator--48809359-0fbc-4a12-8983-c321b66ccfd6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b280cee2-6ddb-479a-b8a4-1937dd781972", "sighting_of_ref": "indicator--84f7497f-8b25-4c96-9952-b7099e077fcf", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b16ec5c7-7f4c-4e24-8ad9-14f24060909f", "sighting_of_ref": "indicator--e300c77b-cfbb-4c4f-8e1c-f95b5cd83c15", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a61b3b7-884b-49f2-914b-e542a07e4d5e", "sighting_of_ref": "indicator--b32c7f92-1b3a-42cc-9df1-620da78dba34", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d2c7ec-295a-42a4-9a5c-cee7cc2108a9", "sighting_of_ref": "indicator--8646d4c9-a294-4583-837d-af0833403e67", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3451068a-707d-4254-90c5-0430a6cdb90b", "sighting_of_ref": "indicator--52c63502-bfc3-455d-adeb-abcb3a73a9a2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31eac035-2393-4f28-9b29-4f5c20616210", "sighting_of_ref": "indicator--c4c20f5a-7674-4687-9580-961b33e0540a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7e0c835-286e-4e56-80d0-36558da6a5a9", "sighting_of_ref": "indicator--acd104ee-c034-428b-81bb-29eb29ff4612", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7625a4dc-ec07-4d34-9d98-031d34c0c8b5", "sighting_of_ref": "indicator--399c29fa-79df-4b02-a361-2e327230f5b2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16ae425a-d228-4ad4-9672-b53146a30fe7", "sighting_of_ref": "indicator--fba2ba13-e2a2-40b4-a958-65a969b75c08", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c64a247-6f70-4597-8e6e-8e01e188f7dd", "sighting_of_ref": "indicator--d7edb48f-2001-4814-910e-d5f4d32c98da", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eb222db7-78e1-472e-ba06-da89dda8eece", "sighting_of_ref": "indicator--af038440-341b-4605-b129-b37820b44e7b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c93a8a62-594e-4b86-a0c1-31dd497870fc", "sighting_of_ref": "indicator--348c3e3f-7131-4ff9-826d-a0538d0a422a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--767264da-de77-45c7-b03a-53d01c3ccf01", "sighting_of_ref": "indicator--65199216-19e3-4f0d-9aa5-3f8fe19b4231", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06b65abf-aee3-49f7-b26c-9e85f2490863", "sighting_of_ref": "indicator--7db9f110-4166-47a3-93ec-fa49e52ed862", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c87e2ced-2acb-438e-9f82-689455cb74ee", "sighting_of_ref": "indicator--57ed8d25-5246-46b4-8ca8-4299e7f25b38", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ec7629c-4ec9-4d38-87b3-0e89bf187b96", "sighting_of_ref": "indicator--d6e7282a-4fa8-4543-9c4e-4db396eb6c51", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac85be74-0759-4674-a1d2-92995e56f6ec", "sighting_of_ref": "indicator--65310fb4-798a-46e6-b2e9-7fca58e06dcd", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f865dffe-6840-477a-b15c-db9e279787b7", "sighting_of_ref": "indicator--363c99da-3a3b-444e-add8-b923cfe90838", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe156711-3c25-4335-bbf5-97156ed126bf", "sighting_of_ref": "indicator--246c787f-4bc0-4bcb-aacb-859b388e2bbb", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88b867a0-2d29-4c9e-b012-57ef6fbd6b47", "sighting_of_ref": "indicator--a473ac1a-128c-48ff-925d-77cc6fb5cce8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7156dbc-7b87-48b2-bccf-9abe5eda3255", "sighting_of_ref": "indicator--2ff2d538-6e9c-4306-b71c-d04f4393333e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05aaf4b4-4f3c-4da5-88ea-4b3d30f0ad28", "sighting_of_ref": "indicator--af3423be-a2fd-487b-a66c-e17a794f64a2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01403897-0ff5-484d-8e01-cf09df2bcdbd", "sighting_of_ref": "indicator--14a149ed-4892-42a2-83cf-f1702f621aef", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b3f9ec-90fe-441a-ad49-3c6aef55ef6d", "sighting_of_ref": "indicator--d2941b2c-661b-4c86-950a-8cd7e5ad91c1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3507e452-2b5f-4711-ac35-dcffa578dc59", "sighting_of_ref": "indicator--1034f19d-3c31-42fc-a47f-165452bdcfb9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0075c831-2398-4a3a-bd4f-b31280c9e357", "sighting_of_ref": "indicator--6a71af3f-9f84-41a0-9c75-4af65053fc98", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4fb90571-f19e-4925-afe1-e3bfedd015a0", "sighting_of_ref": "indicator--bcef7f0e-07da-4b60-a893-b03ac1da7fe2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55988db6-6a9f-418d-88f5-1788b214920e", "sighting_of_ref": "indicator--60ea8249-837b-4f2a-b1f2-b07583104bf6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a605690-f30d-429f-be4a-dfd149c1b1d4", "sighting_of_ref": "indicator--68832095-7225-4da9-a0d0-bef757abd634", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93ccf996-3303-41d9-8f14-8f068d1cb397", "sighting_of_ref": "indicator--9aa1e85d-66bb-4990-978f-dc93b9272063", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--210d26e4-69f0-49ab-8054-1e952fd2f9e6", "sighting_of_ref": "indicator--56c303d8-abe8-444f-ba4d-24a03435d085", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd77bbb9-3005-4557-b883-57a228ad72d2", "sighting_of_ref": "indicator--714f4dbe-375f-4000-abcc-ce202e262011", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d811eae5-8bf8-4377-bb33-ac764a60654a", "sighting_of_ref": "indicator--21a1e2b7-150b-4131-b9e7-51cc56f63859", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56969d75-0bc6-4829-97b3-a4ef1f9c1d8c", "sighting_of_ref": "indicator--ee2e22e6-d214-4bbe-8a38-ae61d75228e6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7b387e4-d888-481a-945a-5e05b8df2459", "sighting_of_ref": "indicator--7818e279-afb0-40f0-ae34-dd266733afbd", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae241a0c-ebcd-400e-b8bd-56fbaf6014d0", "sighting_of_ref": "indicator--69338062-5fbb-4511-b5d5-70813ca2e0ff", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bdf865ca-0e60-44f8-9955-1bfbb0b5b03e", "sighting_of_ref": "indicator--4f765fe5-95eb-47d3-af55-ff817881975a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d5a2b15-43be-45bd-ab1f-ab5e79999a7d", "sighting_of_ref": "indicator--046bfe0b-71be-454d-a89d-9d5be4820d92", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a77c57aa-0cdd-48be-87db-acad9c818719", "sighting_of_ref": "indicator--b4aef7a9-7512-41d3-acd4-6deca9d9dc7e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a5463dc-eef3-475c-9d43-117cc63b1f1b", "sighting_of_ref": "indicator--2d8d0026-5cf7-428f-8c42-03d820b4db8f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7975e505-a3f4-417b-b0e9-99369c99c1a4", "sighting_of_ref": "indicator--13c1bd49-8718-4af4-bfd5-aa7a8f9d94b9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f939137a-e2f1-42bb-b977-7aa67d2cfd43", "sighting_of_ref": "indicator--87807bf1-f7a7-478c-9cab-8225af91e390", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6dfd408-e868-4f3a-b249-569492f9597e", "sighting_of_ref": "indicator--ed982f88-5cd3-4448-afa4-8105db4c15ec", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a104abb2-867a-4462-90b7-35601373d613", "sighting_of_ref": "indicator--3e545ee2-ed7c-4d1a-aa77-b0b2ae058d73", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--238dec5b-1750-4cf8-9f39-18f618ef23e8", "sighting_of_ref": "indicator--16c1253b-c7a2-4d22-87ae-17e085bac032", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67d96492-5720-40c9-8edc-9f723c841b04", "sighting_of_ref": "indicator--0cff831b-94b9-41b1-b815-c18133901e4d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c27306d-085c-445f-ae77-e80b1edbd65c", "sighting_of_ref": "indicator--89b956d4-acf6-40f3-ab5f-dfeaf2c8461c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--348e0488-6f0f-460c-bdba-e91ae8629064", "sighting_of_ref": "indicator--3df93ed6-5332-48c6-a804-0d6910e99e62", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68829096-db93-484e-9104-05efd8d0dc55", "sighting_of_ref": "indicator--911c238c-11ef-4983-9495-60e6c2eff364", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04406160-8c99-40b2-8fe5-b84460b3da04", "sighting_of_ref": "indicator--b666d482-7d33-46d1-86c6-45e741662bd0", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63b74b2d-25f8-43b9-9276-537d3dfc048c", "sighting_of_ref": "indicator--98fa08ff-5328-4649-a887-e390cbe32388", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c66c794-d685-45bf-b5df-a2273e19bbca", "sighting_of_ref": "indicator--c208a117-8598-4226-90f8-8eb9c62f474f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d292a583-684f-41cd-a097-2dcb1614a553", "sighting_of_ref": "indicator--e8776ba9-5372-44ce-b71e-7e2525f3b688", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a747ae5-cbfb-4aa7-9494-5628927d44ba", "sighting_of_ref": "indicator--8a99723c-489a-409a-8b65-9ab2f300f166", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80b0ebdc-245e-4312-9d6d-28fd4f06acfd", "sighting_of_ref": "indicator--cf9fe896-804a-4f4a-b353-824a3058456d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4670eb3c-7146-4009-b926-2a7a54d7e7ed", "sighting_of_ref": "indicator--0a428ee6-6158-49f9-91e5-e08b1143a719", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2d2b51f9-747a-4bdb-b5df-26f77f2b662c", "sighting_of_ref": "indicator--6e96a5ea-b384-4925-8e0f-cc07abc4b409", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd1b7bff-f899-4115-8df6-3061092414ef", "sighting_of_ref": "indicator--6ba4dbba-0044-4cf2-815f-1000970091d5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82c68381-389d-4144-ba2c-4a8f7e1877ad", "sighting_of_ref": "indicator--4b5df7f5-5a7d-4c86-a43b-53023fcf73dc", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7286a4a8-4f9d-4dd5-b649-8225a062de91", "sighting_of_ref": "indicator--532f01de-9a99-4dd6-8be0-d061797c6f38", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea4975a3-433d-422d-a976-bc5bf837fa2a", "sighting_of_ref": "indicator--63099576-1f39-4558-8594-c1257c5bee2c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c7afc4a-2063-4e13-8df1-45e8b5f0168a", "sighting_of_ref": "indicator--c8a2c316-5c67-49eb-bbd8-f9f6a9c349f0", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dcb6e7c-e460-44ab-931a-28db2e6ca878", "sighting_of_ref": "indicator--3a125fb4-67f9-490a-88fa-7821c6be69fa", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--825d686d-8ff4-4ea3-9fcc-89af8428aa93", "sighting_of_ref": "indicator--7f260687-8574-4aec-a79b-b26524dd6cd2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8007a5d9-4182-4b18-8dbf-70b64d1c42c7", "sighting_of_ref": "indicator--6003f4f7-d8c9-4825-9e26-ef38f4ffb23f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76da53ec-c5f7-47f6-9995-de0c23b67f7a", "sighting_of_ref": "indicator--3613e015-6e49-45d2-9f6e-9daaea108735", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--521a5559-12d7-4cd8-ace5-5789ea3eec57", "sighting_of_ref": "indicator--e77f0a68-8618-4af9-b7fb-f63e69f2004b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--814e8d16-71e6-4f8d-baac-70250a456df9", "sighting_of_ref": "indicator--627908fe-15e9-4949-94a9-10ec28a98335", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63c67ee3-2fce-49f5-8c0e-56d7d7f54e96", "sighting_of_ref": "indicator--f1a1dbe3-078f-4963-9d75-49df50a1b18a", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--584a903d-801b-4007-a1ed-6696ef104fb6", "sighting_of_ref": "indicator--1dac47e7-5c0f-48ea-ac93-750f1bf76321", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f1466e2-2f84-4461-8aab-0d9628c6a46a", "sighting_of_ref": "indicator--2b83b284-e5d1-423b-8c94-aa8d2e982bb4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08825a65-78a4-4db8-b0fb-87de31e5bd50", "sighting_of_ref": "indicator--fb368205-72e2-4f98-8679-269e70141047", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b7401cf-1e4b-4205-b32a-5cb1b6aaa7e6", "sighting_of_ref": "indicator--513bd9bc-52f5-4463-b914-2c774931fec4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd77df8-c0b0-492f-9c4c-7a7545832ffc", "sighting_of_ref": "indicator--ee288d35-32dd-41e3-9f0a-f6492f83004d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24020e65-7489-4e9d-ace9-4446cc82704b", "sighting_of_ref": "indicator--e69cc14b-138e-42dd-9044-d8785b618ac7", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1740dec8-3e74-4160-90c3-42591aace16b", "sighting_of_ref": "indicator--2d212b7e-5478-460d-a7fc-0a646ece03b6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6691c61-c11e-469f-aef5-8a9b29b6f8a1", "sighting_of_ref": "indicator--5dbc3324-5fe7-440f-89f4-9ac2d1ec7f61", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aad4b93-d1c2-4c4d-83a8-e3b49488f78a", "sighting_of_ref": "indicator--ddfcd42f-abb6-4fdf-bf30-3b2317a6f1f5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5157719d-9cef-4d33-a48a-3f11ab5e5716", "sighting_of_ref": "indicator--dfc73538-9138-4f53-bf65-4291be2317c4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aed530ef-098f-44ce-be98-26a29e549c13", "sighting_of_ref": "indicator--72f1cc79-eaa6-448f-b644-1eb525b3bb9d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--065542f6-5216-42de-847c-a572a88d1ce7", "sighting_of_ref": "indicator--8ea5b7fb-4332-4be0-8dc6-3a7fc3947204", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--826a2458-5247-4b50-b6f1-bdaf8447a089", "sighting_of_ref": "indicator--3bb46394-ea2b-4542-a225-4372c41dde46", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9220615-ca0d-48a6-9a4e-2a15d03ef1d4", "sighting_of_ref": "indicator--acd3fd8d-0033-4492-b354-a4a5ad190f24", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f62fdf9f-de71-4dcd-b88f-76ca954a5b83", "sighting_of_ref": "indicator--f4948169-d64e-45b5-bffd-2b0f525d3a39", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8323a1a1-adc3-4890-b7aa-3b69724d38cf", "sighting_of_ref": "indicator--d0996367-4fb0-42ec-afca-8c6005cbd1ba", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d65ec872-ec2e-4c10-9d69-e20a1c1bef79", "sighting_of_ref": "indicator--e55a0823-e471-4765-bdca-bfaadfad8c69", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--934b2de6-c671-4314-8101-4454b7324925", "sighting_of_ref": "indicator--97ea3b09-bfb6-40db-9257-2ebe41263d3f", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--574f9844-dfde-4490-b6ce-dd91302817ab", "sighting_of_ref": "indicator--dd85e14f-925e-46f2-a662-836d4e30ac85", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0172440-b277-419f-a9d2-bc5e360cab92", "sighting_of_ref": "indicator--f486b6ef-d4ba-4e93-a3d2-9ce963052628", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab9a58e4-b73d-4308-a00d-ef499a6265f7", "sighting_of_ref": "indicator--63a8f82d-e867-4d1d-8c86-adf98185f894", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c95039a7-52d1-460d-af80-9644668ba197", "sighting_of_ref": "indicator--529005ec-d5d9-4424-9ecd-a93488191ec5", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1479e6b1-97a8-4dbf-983e-033f169406a1", "sighting_of_ref": "indicator--0a27e453-5ffd-45cb-bb25-c08566f93e41", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f2d09e-e9ad-4c2a-b271-58fe3d7687cc", "sighting_of_ref": "indicator--9b613ed4-b4b2-48e6-a446-aa3cc46404a2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b42689e-e1bf-4f1b-a703-f5719869c7cf", "sighting_of_ref": "indicator--755ea6ca-cfd4-4407-86d6-3c54c6e6c2d1", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0868ad47-a95b-4135-9be8-35f141dd69f1", "sighting_of_ref": "indicator--62292988-0e5b-4766-a34a-e742be965b68", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9abbbe5-6cb6-4b36-b836-b3043abd6038", "sighting_of_ref": "indicator--feaa700f-17c0-4e37-91e2-04fe1eed2a1b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7dfbf1b3-5b3e-48d0-be3b-9d5456bc2a70", "sighting_of_ref": "indicator--e86aa672-48d4-4118-b538-92538230e2c2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--128216dd-8915-43e9-bf3d-939f6fb34078", "sighting_of_ref": "indicator--7202b519-a2ab-4b1e-80b7-02df96f5615c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49c66d01-9668-48fa-abd3-971f9d7d9186", "sighting_of_ref": "indicator--227d5e7b-420d-420e-aa95-cd0595962eda", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f98e482-568e-4e0c-979b-3923040567cf", "sighting_of_ref": "indicator--01a56516-83c7-4dda-970e-9c60d4388e1c", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--79d84b93-abe5-4ef6-8496-6e1128c67329", "sighting_of_ref": "indicator--2ad58606-53e8-49a3-bdbf-27d60276759d", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4408d733-2fd8-4059-9fc3-aa4138b8a88f", "sighting_of_ref": "indicator--a4392e8f-ccd2-444b-bce6-4c74ce36045b", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f59c9529-f371-4277-b2b1-e754f930cdc0", "sighting_of_ref": "indicator--68dd70e0-7d14-4113-bb01-f7e28c0dc2b7", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36aa6d91-8049-49fc-bbd3-f03d5d16c7e7", "sighting_of_ref": "indicator--b162e8f3-9d97-4cc6-9076-c2bb79e38257", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c164d12-8436-41fe-89b5-85e724712fa7", "sighting_of_ref": "indicator--fdff1cc8-2921-4878-ac2f-c126c0d4e19f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d29ec2fd-398c-45ea-9734-d836eee4de31", "sighting_of_ref": "indicator--8d128dd3-a55c-4475-8cb4-703323667d17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--539141f0-a317-49a9-86a9-04b3e3ab7882", "sighting_of_ref": "indicator--5a85fa23-8a5e-4011-a6a7-e8469f49f833", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f3ab105-7f78-44ca-8458-333351c4ea44", "sighting_of_ref": "indicator--0a05bdde-9c3a-4c9f-b781-eefe7e5e33f8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ab4ddd3-3cb8-477c-908e-277337097f63", "sighting_of_ref": "indicator--710dea84-fb6c-4b21-8b61-7037f3425e27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3974c990-5ec0-4ad1-ab3b-955a88541471", "sighting_of_ref": "indicator--a971c147-a6ae-457e-ae5d-7d5c3bbab5ae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11d977f0-264b-4cb3-aadb-7fae5215ab5c", "sighting_of_ref": "indicator--e970623b-4d13-4248-8d29-aa7d1bfc960d", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2689961b-c42f-4069-9beb-86723519fdcf", "sighting_of_ref": "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aad46ad8-9ed4-4564-8314-baf0ae1ea0b5", "sighting_of_ref": "indicator--106c5ada-c821-4dd5-b54b-80db6cbe00f8", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--762d6057-7a49-4948-bb85-140372ac118c", "sighting_of_ref": "indicator--106c5ada-c821-4dd5-b54b-80db6cbe00f8", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2e357a03-4d72-4d76-a59c-6e5201d36044", "sighting_of_ref": "indicator--ecfc4157-6cd6-4082-bf8d-87f8491ddfc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e102aa34-432c-4527-99de-7212e5a115c7", "sighting_of_ref": "indicator--20990b35-30da-4bb3-a51f-d059d95644e9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1d26b36-2306-433f-b7e7-bb1c18ff753a", "sighting_of_ref": "indicator--f7bdc89d-7cd9-4830-a3ff-4a5450905700", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fdaee7cc-c623-4ce2-ab3a-287e29aa3f22", "sighting_of_ref": "indicator--676aea94-159c-4cc7-8057-5c406466d4f2", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44dc9b0f-16a3-44c0-9ad4-23cdad87f047", "sighting_of_ref": "indicator--410a8cf1-9a90-403f-a035-1017ca534cc5", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7df0159-e5ab-4599-a4b4-5c5c83405f08", "sighting_of_ref": "indicator--754c17b7-79a1-46d0-b7d3-42e9c344bce9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ff8fa53-2a06-48f7-b4bd-7624a03f5d9c", "sighting_of_ref": "indicator--5c6ae8e3-50e3-4af1-ad47-2e182b5db463", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9436d35d-1a5a-4283-9b62-c1c357b9f46a", "sighting_of_ref": "indicator--da91f050-42fc-4877-a096-18aa8a578fb4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c7c68ff-8f50-4968-bfb4-24ab206af933", "sighting_of_ref": "indicator--4e6e2482-60a0-4bca-9019-f7a36144c0a2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e1601a2-9aa3-4fe2-863a-613abc286887", "sighting_of_ref": "indicator--cbb901e8-50f9-40f5-9e19-7958ea8fc5b6", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c04f00a7-3613-47bb-a88d-0f8dea97e6d6", "sighting_of_ref": "indicator--3955f1d8-0d6e-4706-bf3e-70d292e07f06", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ac3b3515-d3a1-4b36-bc02-04e1f5543366", "sighting_of_ref": "indicator--c0bb58f6-6ce6-4cc1-a617-80a7b221810b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff3e06ce-8242-46ff-9cad-23e16cb69bc3", "sighting_of_ref": "indicator--d20ac705-708d-45a3-a916-3442c2f6e2a4", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a16abea-3b03-449f-915b-0edd5a83bad3", "sighting_of_ref": "indicator--e949b4dd-513c-49e2-8d43-bfb41465f76f", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--533bd5ba-f22e-4963-a45f-7ac9998cceae", "sighting_of_ref": "indicator--0599ae84-e977-4f76-8d73-1558e89222bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c9d9751-1067-4541-9d1b-fc9e538fa2ea", "sighting_of_ref": "indicator--7fde424a-0d23-49cb-b708-7a106013878f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd5b14f4-8c90-4b73-9634-7ea81c415b20", "sighting_of_ref": "indicator--2ac553d9-361e-4837-9b7f-9016830e7e3b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52ae46f1-f02f-45aa-8031-ec2a12433599", "sighting_of_ref": "indicator--c16fb374-3ef2-4357-8c45-c510bd580c28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc732a0b-0424-4113-8ef6-93e0bfa52b22", "sighting_of_ref": "indicator--b9b30fcb-23db-48be-b21e-8e3b687beaa5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fa8c47c-098c-4e72-a258-4db9cbd16fe9", "sighting_of_ref": "indicator--0444a18f-cc6c-40a7-86a2-93f29598b93e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc05b26d-8ad7-43ba-be71-93352504a787", "sighting_of_ref": "indicator--b7cd9d32-6326-405c-bff9-2c61de61bd40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--822f585c-0768-4d07-8301-e1909ea13557", "sighting_of_ref": "indicator--06ba4cab-b882-4cf2-9815-f6c641604b6e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bf32d96-779b-4eb6-8b12-d4e31090455b", "sighting_of_ref": "indicator--00416e43-3de9-4d04-95e6-c7f131b40ae5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--095c887c-5af2-4cae-aa2f-d76942500aef", "sighting_of_ref": "indicator--9f03fadc-8fb0-41e9-b335-a9a756c25c11", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4c2d68e-2073-4610-b126-f31edf4f3ba4", "sighting_of_ref": "indicator--0126bfcc-3842-40fb-9e69-4fed8d9d5149", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--813738da-ae11-4105-8a2e-1130d6477db1", "sighting_of_ref": "indicator--a0274c21-eb3e-485b-8798-de6fdb9e78b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e9bdaab-be38-4172-a4bb-7caf039b8f6f", "sighting_of_ref": "indicator--549451f4-47f4-4270-93cf-07541eea1134", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb545477-dd71-41f5-a7e2-ca8735a7cf6d", "sighting_of_ref": "indicator--6824a62c-cf69-495d-bce9-04870c28d775", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ac16d60-0517-4e5e-8a4a-b825195a9d80", "sighting_of_ref": "indicator--50b2b559-e6c3-4130-a830-26d616664fd7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--208f4fe9-6104-42e3-abd2-6c08efc8e8e3", "sighting_of_ref": "indicator--c5fb3233-f676-4eb3-9376-10ba78ba2618", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2aabef60-82b8-43b5-a415-ddd4cb290cd5", "sighting_of_ref": "indicator--6c99b467-37c5-4bfc-9e0f-5ad20510304d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04d05cd5-9f0c-4c9a-8923-41e369489391", "sighting_of_ref": "indicator--0e62d9d1-ba00-427c-8aa8-17ad977d8b88", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6c0c99f-cf95-45d5-b45e-7e9baf3884a5", "sighting_of_ref": "indicator--e032d22e-2caf-4b45-8d47-efc8925030f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a27af81-8e05-46e2-8dc7-613b74083796", "sighting_of_ref": "indicator--5fc8acdf-2624-4be4-8e18-8813e5f63478", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce94ced5-04a2-4b0b-84e9-876179a7c2a0", "sighting_of_ref": "indicator--450ce257-a129-41f0-85f5-a8d34c4dce71", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc573dba-c4c2-4ef5-87e9-78962ceeec6f", "sighting_of_ref": "indicator--7e31c398-5bcc-455e-afa2-4771df4e3879", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6adf5cf5-14cb-4301-ad54-a0694cbe3be2", "sighting_of_ref": "indicator--0268561b-14d3-4a14-89cd-efaba7c4b22a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7628d679-ee5f-451d-bcd1-795c59b40824", "sighting_of_ref": "indicator--4d90714d-dc6a-470f-a662-2acd650f9660", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--964800ae-45f5-467e-96e4-2530492b6280", "sighting_of_ref": "indicator--6318fa1a-2382-4614-a459-b73fc173f31f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ea4fbe-368d-43e5-a798-080d1171b4f8", "sighting_of_ref": "indicator--fcc9cbbc-257b-4760-aa4b-996ae4ae67e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adcaf515-31c9-4739-909f-e1f463e8a74e", "sighting_of_ref": "indicator--433999fa-266f-495e-905f-4e269b3cf111", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d7fb565-1b46-4122-b08b-97436c1d7414", "sighting_of_ref": "indicator--358509bd-0359-403f-86c5-462378024fa5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c81214-5396-4e85-8fc3-956733e042b1", "sighting_of_ref": "indicator--59b5cdc3-07af-4da5-9603-c385a939570c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe1c2eb6-8fea-4636-bfa4-b6622309c6e5", "sighting_of_ref": "indicator--94e56fd3-c9c3-4bbd-8791-459a43df40aa", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f8d76f9-b7fe-4426-9a63-d27c2f5a96a1", "sighting_of_ref": "indicator--30d97eef-866d-47a7-909a-2094b767cb2c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61ca14bd-a7ff-48db-bb5c-2a32c2d9bcb7", "sighting_of_ref": "indicator--fe2bc1d6-3918-4c16-b19f-b959126b4db8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ed381bb-cd3a-47c1-8395-5df38af1b3ee", "sighting_of_ref": "indicator--87256ec1-6bb8-4bfb-ac05-579df70c1a9e", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95e69dbf-89e8-4451-ae7f-2b1121cd2b63", "sighting_of_ref": "indicator--d7feeee9-a699-48e3-bd4a-1d256c3744a4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32334d21-0acd-4e38-b961-c4b23a45add0", "sighting_of_ref": "indicator--4fb8e309-07c8-41c7-82c1-1ac8b1651fe9", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a84d38a4-664b-4414-a37f-0e263a0b6ea0", "sighting_of_ref": "indicator--291924a2-2d7f-4602-867d-20c0f8906e6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c95ae86d-1c6c-473c-bd1a-719d1c738a45", "sighting_of_ref": "indicator--4c1cebb1-3060-4987-b685-d0240d4db654", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff2dd873-90ec-4bc7-a79d-082d96165520", "sighting_of_ref": "indicator--01282649-f242-49c2-a624-96b2276b5f72", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--818f0540-463a-4f80-afdc-d0d670b53720", "sighting_of_ref": "indicator--633fb2a6-a4ef-48ae-90f0-74fdfec61786", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--51241a94-35b5-41ab-bc39-75998ae7f6fc", "sighting_of_ref": "indicator--12604eb4-8d73-4b88-adbb-0131f91f3cb2", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2a88f210-3d67-4c0d-a6a8-47d70919dd9d", "sighting_of_ref": "indicator--12604eb4-8d73-4b88-adbb-0131f91f3cb2", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a71f3f0-3b5d-4f1c-a591-800efc4b4dab", "sighting_of_ref": "indicator--afbd4abf-f84a-408a-82f9-96baacf1c110", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13a5b62b-340f-4991-a1a9-3a85f65f913d", "sighting_of_ref": "indicator--afbd4abf-f84a-408a-82f9-96baacf1c110", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6902a50-3a97-4bf4-8a8d-a1846bb43da4", "sighting_of_ref": "indicator--4d1bbc6b-1c34-4feb-8f2d-e7b435837b8f", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8292e9b7-61e1-4c5e-90b5-cf5a16c3920f", "sighting_of_ref": "indicator--49d86f68-b9aa-49c3-9517-5865cae3dd46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37fde53a-f603-4ace-91e6-4a67d058ea19", "sighting_of_ref": "indicator--ad6eb1a7-4c58-4f22-b957-ba89d8d77655", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8aba42d-2751-4975-ac92-e11962e530a3", "sighting_of_ref": "indicator--4cf2be0c-9634-498e-9181-77c4c8050d9f", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfc71bd-2a5e-4607-afe3-6bdaa8f0c16d", "sighting_of_ref": "indicator--354ef7b7-bd39-4eec-9093-3de61854641f", "where_sighted_refs": ["location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee921ea-c581-49b6-b2cd-643ba9ef1dba", "sighting_of_ref": "indicator--a489af77-6af5-4510-94a1-5ad3d5f2d0cd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9372c6-ef8c-4e17-9d54-42f292eda792", "sighting_of_ref": "indicator--0b376275-aa13-4033-b8b5-526e6af5e6b4", "where_sighted_refs": ["location--634fdbac-744e-4d12-810a-99d7ed407fc1"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2991d29a-1248-40eb-84f4-b815dc949723", "sighting_of_ref": "indicator--6cdbbdb8-c66f-4399-9a97-2a913ca20a83", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11878167-10a3-4655-9ce5-e83932e6f3a8", "sighting_of_ref": "indicator--687b60d7-cc36-4611-bcab-6adc8c2be9b8", "where_sighted_refs": ["location--8687c4ed-ace8-4ca9-b7e2-13f282274714"], "first_seen": "2026-10-11T00:00:00.000Z", "last_seen": "2026-10-11T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--032264bf-f5f1-4064-9a83-b275aab94707", "name": "Threat Report for 2026-10-11", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-10-12T11:00:01.514Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--8687c4ed-ace8-4ca9-b7e2-13f282274714", "location--bca0e73b-fc35-4bcd-b7c3-daa9b8a9cb2b", "location--634fdbac-744e-4d12-810a-99d7ed407fc1", "infrastructure--02689cac-120a-4645-a7ab-64fbb4d88d11", "infrastructure--ae74dded-ee4a-4b96-b031-eca438185594", "relationship--d6c54b38-184b-47a1-b40f-cc7632ff4cae", "infrastructure--186a68b0-e440-4a09-aad0-8ad7538a508b", "infrastructure--efd4825b-0678-455f-923d-abb05bae098f", "relationship--7f438798-147d-41d4-9648-1c2281ba3473", "infrastructure--14d1e293-0ca1-4b3e-be6f-67a379f11678", "relationship--ba70708a-93e4-4977-8eaa-a8361461ce38", "vulnerability--17e83410-4ed1-4799-a0a5-0a947dd6da52", "vulnerability--c1a87e43-9a27-4d10-abcd-f162d40f9e82", "vulnerability--8e8a24d2-fac8-404b-8c74-41eb51539852", "vulnerability--0a4842d1-a35e-4b65-8089-1e4c32aeb9fb", "vulnerability--22d0694e-f801-4410-a6be-9d12864de351", "vulnerability--d8af4f4f-f3a1-4be6-a66f-711cad88156a", "vulnerability--23b9dc8f-bcd5-4ce1-a916-a4dd5ce01120", "vulnerability--9fba7cb8-46b4-4e8a-a2f4-3819db065146", "vulnerability--89318c9f-88bb-4eeb-a06d-001c0f7b34fb", "vulnerability--9b8dbc2d-ec7b-4e97-ac85-08998f606893", "attack-pattern--bdf5b6f2-cdaf-4e76-9190-2c074d80f375", "attack-pattern--adcf3c2f-6282-40d6-940c-92efa6ed24eb", "attack-pattern--de935105-c69d-44a7-8759-886a2872d0ba", "attack-pattern--3f90a8d5-0692-415a-8ce8-e22393e40da9", "indicator--25f00520-ef1c-409c-8404-aa5b2b9b4829", "indicator--fa8a5177-28dd-4478-a1ce-02116f1a570d", "indicator--cb94db33-bedf-446d-b2ea-42e350d4e7f1", "indicator--4ab38cf6-a1ae-456d-9cd7-ddc0e82e29ad", "indicator--67010d26-ed52-4c77-91c2-0f5f90e4c59e", "indicator--af3f980f-f179-48ea-acd0-8e7c4932d821", "indicator--067adf25-db8c-41fc-b55b-46ed68ed4929", "indicator--cf808fb6-d415-4534-ba55-71defbe9f0a4", "indicator--00ec5cee-acb5-49ba-8893-93042306844b", "indicator--7b27f4e7-58c3-4b0b-a56a-0cbe54786e02", "indicator--59f5aca0-293e-4a12-ba83-7c65bf4c57a5", "indicator--03311801-30e5-4c76-9d6b-86aa0a5f2f90", "indicator--3157b776-439f-485f-8770-2a8a54a17ec1", "indicator--0b52e1b4-fa34-4063-95f3-3ebf6b23f412", "relationship--c559b6d2-14a2-40da-9f4b-40f26b8c8265", "relationship--aa8611f5-539a-48ce-b552-5fc435d26534", "indicator--ace340fd-bdd6-43ea-b264-10ff31046437", "indicator--b56af4ae-f042-47ff-af6e-dc0b092dc701", "indicator--09f7536f-91f0-4e97-8feb-fb564e99cd74", "indicator--29a56062-0c60-401a-982f-380b09ec5d05", "indicator--765d0454-6d0e-451f-a939-cf7438dd544f", "indicator--82b5fa67-8644-4ef9-8b82-befbe404b7ba", "indicator--3bf1c33c-fdda-4009-b229-a189f9a295ef", "indicator--2fb3a81b-e2ea-4b64-83ce-985501399779", "indicator--765aaf70-aecb-4e44-8d8a-6a65f3495b20", "indicator--20bc89a6-b247-4ce8-8b13-b9f5884c87ba", "indicator--ee94b853-f1ff-4a1b-9766-3ea2e9b55bcc", "indicator--96e6d398-452b-4e1e-b279-6a9f0eaabaab", "indicator--27010ee9-0e0c-43f8-abff-620d1968e716", "indicator--8130436e-aa9f-4878-a348-9bf682474685", "indicator--3d2fa439-c56f-4851-9ae3-8b9dc42b4863", "indicator--e850d505-1f73-4cab-bad0-18fcf520a4f3", "relationship--88d38b3f-1e7c-48dc-960d-a678aa54549b", "relationship--46f1712b-2c79-4347-8e8f-f800f29199e8", "indicator--f64e017a-f8da-4346-b30d-e628da189540", "indicator--54b093f3-f0aa-4818-8269-a5100259d2e5", "indicator--7ea7b23b-cc08-46f3-ad69-5dcfdc00830d", "indicator--2581a85a-da36-421d-a87a-8b1d2175800f", "indicator--4e6ff261-931d-403b-b0b9-ef7f3fd7ebef", "indicator--745368a4-d0a0-415d-b797-0c0595800f1d", "indicator--10f8862e-d544-48bc-b278-2509c8d446f8", "indicator--7b8a325f-4a70-4412-ab97-e5c9fd1177fc", "indicator--29308b02-e361-4968-962b-f0c5e1e0584b", "indicator--d6d4a14c-9870-4805-9df8-2680211dabc9", "indicator--b122875a-e332-4154-8f63-8238b298c492", "indicator--ee49b489-29c4-4d93-94ab-fef3e609c6db", "indicator--4ab01dc0-2c15-4de1-a952-7d981ad76654", "indicator--e96ebdd1-7165-429d-861c-271a32ab0e32", "indicator--b45e6409-dae8-408c-b141-83f56d961755", "indicator--b2ceb35c-f1e6-49c2-ba90-310daa47470c", "indicator--768dc7c5-f26a-403b-85a6-ec60d576638f", "indicator--d560c83c-cd2e-4da7-b61d-61a05e9feb21", "indicator--9fcef847-9865-4b93-aa84-7e90fdf659ba", "indicator--230b49a7-ca55-4d3c-a2b4-dcc5e4d054d4", "indicator--0d9f9bc9-b623-49bb-89f1-2256c591d4f7", "indicator--a9ed53e9-1dcf-4280-a901-5c359d3806ec", "indicator--ba06f7ac-4b91-4169-8fdd-01d6ecf8daaf", "indicator--cb930753-08b4-4658-a492-bdcedf4fc375", "indicator--f6022046-6816-4815-a33a-f26fd5cca1a7", "indicator--412601ca-e3d7-4740-aab7-1edcafd83937", "indicator--7686c978-a0a1-4d2e-bbc0-853d7c4a5455", "indicator--f46c7506-1295-4677-90ed-73b120c3651d", "indicator--050ef3b8-83ff-4932-9434-296aa95f34b6", "indicator--03163b1e-2c9d-4839-adbf-17180f343899", "indicator--a35c2dcc-3824-437d-943a-9ea71ed5d7f0", "indicator--381f8776-10d1-4c34-ae18-241d7b51a817", "indicator--617b4f1e-13c7-463b-b794-6282dda0ba25", "indicator--1a7e0904-6489-40b4-9602-3be8ef7e7155", "indicator--989f9d55-5c83-43fc-a9f8-e008aa30d6b5", "indicator--c922f159-145d-4f7e-b75d-fb0983b7ac60", "indicator--2f15d973-47c6-4c13-a14c-882febb41a88", "indicator--a02dfcb1-2bba-483a-8d14-b24543fa5a4d", "indicator--8c290919-fa98-422b-865a-bb493bfc01e1", "indicator--3768731a-d92d-4f36-80b8-d0f6090492ea", "indicator--24328671-1d5e-4178-8a36-8cde4461c3b9", "indicator--0b13c559-8f49-4bc4-a5d9-37a713e296fa", "indicator--1a02038b-fdaa-46d1-8102-7642bae89174", "indicator--c622888d-8c85-4523-b1d6-8edb3a24ab65", "indicator--0b65106c-6225-4c9c-8b7b-0c516f6dfe25", "indicator--6f542b1e-bdec-4255-bb73-a64adfd303f5", "indicator--cd720be5-bff5-486d-8f3e-bbc1aba9bf87", "indicator--b837a2c4-b25b-42e4-9776-76e48305b634", "indicator--dbe22428-fc8a-417c-b352-c58f51bbdc9d", "indicator--eed92078-aaa3-4bb8-ba59-c8a21d336b8b", "indicator--fa0d581a-20f7-46e6-a5e2-da23733d3e56", "indicator--a4dbed2c-a3c5-45f8-9e25-d64e9f5a146c", "indicator--64b11a9c-7bfd-4218-bc84-889267af9791", "indicator--c1219165-c161-4266-9cd6-e30b8fb40868", "indicator--238b11ec-ec55-41be-afa8-f5eaef1cf6b4", "indicator--b612858e-dfe8-45ed-88d5-703c9dd0f0f5", "indicator--66e5d4a8-c3e5-4634-b28a-d624061f3708", "indicator--f6c2bf63-15a4-43e2-bbfd-6a714abf6211", "indicator--e073627f-a8dd-4758-a642-e19ddaa07be3", "indicator--91205b3c-8a6c-4e74-aaa8-7eeec34fc9f6", "indicator--76eb525f-a956-4a69-9205-bba1d7a29a24", "indicator--ad3808e3-dab6-4b98-9190-0ae5fef5da92", "indicator--a51b5dfb-f0ed-405f-82e7-b1ca9797ccd4", "indicator--b8d4cbe7-e853-4865-9c85-10ae3cd2b63b", "indicator--72d37a6d-cbe7-4a85-8f19-a4636c368e2a", "indicator--3282b9c1-5933-44bd-b07f-f75f272ea940", "indicator--0855172a-3736-477d-8296-358a051621c8", "indicator--b3c792ea-8d66-493a-9871-08a5e509db50", "indicator--f1a1b554-dbd0-4efc-8d80-5e5a502035e2", "indicator--1b089b29-ca8a-4561-8dbe-1bfd77eee9e7", "indicator--7460e9db-836d-427b-9ef0-3252a83ba5cd", "indicator--7acc34c8-dc99-4af7-aef0-b88293799707", "indicator--6c2c92fc-521c-4c31-a3a5-8c44cdb5005d", "indicator--6151fc4e-d704-4c90-908a-9468494ae352", "indicator--dd059798-3a79-49b4-9657-8b6bb19f7b01", "indicator--7ddb143f-632b-4452-9b31-4664d522d1a5", "indicator--074bb10c-bf01-499e-b364-754c0bb4ddb1", "indicator--1f284610-06ae-4e0d-bf67-b1de996b1a6a", "indicator--6a957c2b-ea64-45a4-84b8-8327cd8e73b5", "indicator--e2d34fd2-edcb-484f-afeb-0aeec67c2385", "indicator--b03784d3-8287-4d02-9605-d28b6802493a", "indicator--e25c95fe-5faf-455d-a681-31bc178b51fd", "indicator--b5cf601e-964d-444e-8bba-d526fdf2b7ae", "indicator--fde38758-4e13-4a23-976d-1cac48d424bb", "indicator--67e92444-ab64-47dc-adab-9319c7b96b2b", "indicator--9c7bc569-44af-43cc-a6fb-c55973b0acb8", "indicator--90172170-000c-4f43-a2c3-b4d439919ebd", "indicator--ed1fc9ff-8e1a-424a-b62f-04214d04c1e0", "indicator--32185a9e-49f8-4eb4-a124-60a1bf99f243", "indicator--5b02e4c9-9256-415b-9ccf-cfdd2c5f4264", "indicator--79b81c81-3887-4343-af3f-b65fe067fd5e", "indicator--5405af2c-b998-4c43-ab90-aee656739635", "indicator--1411e2f8-8a0f-437a-be4c-f7126e39edae", "indicator--66f19378-4835-4131-a909-21cecd7dd31c", "indicator--d1e0586b-5222-4eee-acb8-af4fc6522975", "indicator--8817015e-164a-4f7a-9a1e-98241281513c", "indicator--88ede854-ce80-4162-a9e6-7e4c72dccceb", "indicator--3baedc44-721e-4e01-b00e-411b43691405", "indicator--bff9b5eb-2678-4f25-814a-cba58a7a5e8c", "indicator--3b417085-4247-47ac-a370-5d4988606ec9", "indicator--fb1e0ea0-c594-4e23-bf29-f8d3db3bff8e", "indicator--97cde0c3-3774-4486-b235-137fc8587b63", "indicator--02be87eb-4fc3-4af6-bb6c-22290489a6f1", "indicator--3a817664-f4a5-41fb-8eec-ec8a2795f995", "relationship--254d5f94-7a4b-4e7a-8ef6-602f429832a4", "relationship--bbab6072-07ce-49e3-bafd-c2535bf2352c", "indicator--36145130-500d-494f-8fdd-50978e422d4b", "indicator--f57526de-177b-4e76-baeb-3e4b07467523", "indicator--cb1f80f4-2b5f-4372-862e-71533b597ba5", "indicator--3f7ddcdd-2444-4420-803a-5a2553446f48", "indicator--5b46c3fa-0c77-44a2-97df-3a6a0be1ed44", "indicator--7b877a84-a9f6-47fa-ac04-50be0915d867", "indicator--f40831bc-6f33-4df9-94b4-f566b3a9fa86", "indicator--dd1b75f4-b9e1-44f4-a4b7-8fd209ea0ab6", "indicator--2f44e7c6-6e58-4792-b617-7c5e5ea48531", "indicator--8db5d369-55df-4d5b-8c7c-0f205e29fda5", "indicator--cb807d52-3469-4df7-a2b3-7314b530906c", "indicator--81b680ee-183e-419a-9411-c2ad5445a7e5", "indicator--23bc2e0f-fe3a-4d4b-bb94-27fc9739412e", "indicator--3a9727f3-44e1-468a-907d-8158a93364aa", "indicator--8a8ffea4-8712-4140-a050-9be56b5ed873", "indicator--ec56840e-5c89-4673-a7f5-eaa0d98a6d49", "indicator--d97f02b1-ff24-4039-bda9-0579d6c37a71", "indicator--432da589-effc-4982-b476-cb0f898330b2", "indicator--fca1531e-afc9-4c4f-9a91-410a4f0234cf", "indicator--104541e1-e367-4159-b9de-fc810f7ab2e6", "indicator--b4a130da-7e3d-4421-a60b-dc84f8098bc2", "indicator--ecd4fb01-732d-4b0b-b7c9-be630209c5ab", "indicator--09f06cc2-0887-4f0a-b1c9-6ee99d5da232", "indicator--3acb8be2-d255-4c0e-a95a-5ffd3e68af27", "indicator--bb355bfa-e6a7-4bb7-849e-2441b07d12f5", "indicator--7a939874-c1f2-4bfd-b249-7f6df07a9640", "indicator--9c3708ef-e336-4b0a-98c6-c18a0ea5e5ac", "indicator--4b3007d2-1ad4-4309-b1d0-aefb94da1865", "indicator--ca9e7a38-89a6-455a-9824-321fd2272354", "indicator--f1e4c3be-674b-45e6-a9f3-39df8982e822", "indicator--5cde4680-15c8-45b5-a83d-c0e6adf75300", "indicator--7a14e5c1-e5a2-404c-a767-04dc686f2253", "indicator--48b22279-6c0b-4491-af97-d6d0a2d8fb5f", "indicator--98548f14-5f42-4b1b-a9e8-994888088ddc", "indicator--a006d4a7-df7d-4990-9186-09b6202e5c8f", "indicator--eb12a571-1373-4cd1-bd59-7697a3b120b6", "indicator--3f7131d3-a682-4fdc-b51f-18909e7cb507", "indicator--a16b29af-9330-4ec8-91c0-73fa541501a3", "indicator--8b50d3c9-96c3-4780-b4fd-abe93dddca03", "indicator--fc5bf8f5-cf28-4175-8079-cabc4807a8e1", "indicator--7e889c0f-e1b0-4529-adab-33eae400c02e", "indicator--7677c8f5-75d0-4d62-a72e-ad450941c025", "indicator--381a4e02-c4be-43e6-b84a-e574f1cdf0ac", "indicator--79c3a138-5e42-4b01-8180-c5db3a8f8216", "indicator--1029e322-6d5e-4068-b1db-f1cc01975e93", "indicator--bf675748-d62e-408c-a887-3644a75c25b5", "indicator--88a61d69-feb3-4342-82e7-3d86c698d778", "indicator--6cd6ec67-c1e8-4f40-8f22-8dd13f47c79f", "indicator--4206dee9-8ce5-48c1-a706-c2ae0996c07f", "indicator--a561752d-f6b9-48fb-8021-48ffb8f4a016", "indicator--d421677f-c0b4-4cf2-9eb8-9cb48f081b38", "indicator--b1d35bb1-f42c-4631-9695-456e4617c2b3", "indicator--f3515843-ff6b-4061-818a-0c2274e98596", "indicator--667e0250-8f94-4d45-bf2d-b9054d2ee65a", "indicator--f6821926-e671-49b4-bc5f-9905dfdd4493", "indicator--dfc2ffe2-0108-4d0b-8daa-4503fac3046a", "indicator--27ec2445-fbff-4c3d-85fb-226d64e80afb", "indicator--cec56a26-ff8f-4721-8885-a921e7b60467", "indicator--680e9a1c-86b3-4f1e-8396-abb40daeb587", "indicator--6c993762-0c1a-471a-b1ce-7960e2320bc0", "indicator--ec90818f-65c6-4b32-9ef7-aed6009a7e2d", "indicator--e4c09622-0993-43ef-bf10-a6e43736adef", "indicator--24c74dfc-9855-4b34-8f1c-d19eda3d3f7d", "indicator--11e41fdc-a82c-4ad8-a1ff-475aab0660f3", "indicator--3ad0bb50-a542-4fef-8af8-e8e63c7e9a84", "indicator--10c208ee-7645-47e6-852f-6f7bca46de33", "indicator--1637c074-7869-4db3-b3bf-4a406ef9ed1d", "indicator--6b7ac8f4-949c-4b60-ab59-acae11c72ce9", "indicator--70aec19d-143b-4a63-a84d-b0448db64b19", "indicator--45fa98b2-d998-4074-b021-4e29884a9fde", "indicator--f9f84753-29b6-41bd-be6c-6d6ebab78507", "indicator--9c8775d1-436b-4ba1-b747-740f8fcca1d7", "indicator--87fe0552-d5ae-44eb-9c11-61fcaa0404bd", "indicator--10acc819-c6a0-4d57-8473-18bbb9ca980d", "indicator--ca462439-4358-43a2-acab-2834c3c0a32e", "indicator--79779657-e893-4c29-adc7-2b28f6e144a8", "indicator--1748a7a1-a0da-4467-9ffc-c09986e1e5ab", "indicator--e9ac1c13-4678-4a0a-aa49-69ec4a44f359", "indicator--ce23e932-d72a-4c40-8d46-b48c5e78f293", "indicator--ef3cafcc-64d6-4dd2-8bec-63a06642d56e", "relationship--5baa4322-4109-4d26-8f20-a305317cb3ee", "relationship--6a04681d-db87-43a8-be5d-e166c1358305", "relationship--f622e3e6-12c7-45ee-a115-fc9cfe7abced", "indicator--fd2411ae-9feb-4fb0-9397-2c55f8c15afa", "indicator--eb32be5e-c428-4737-b5ec-055191ea314b", "indicator--e9a76d64-0396-451f-bd75-2f710b8d9f56", "indicator--f9443690-a6a4-49cd-ba98-f7531ccbb60f", "indicator--101ebc72-31d3-4526-9c66-2db03cbc2b3f", "indicator--b09b80a9-e0d8-46b0-9e15-e342e86ec751", "relationship--f161ccb8-68d9-42d4-85c5-0ea2fc6f919a", "relationship--2b2c0163-8618-4c0e-8488-9b22c69659e3", "indicator--d3d6c783-45ea-4ab5-84e1-c28bc6785789", "relationship--d31da6b9-ab69-4122-b3ac-3bd2e7e617ee", "relationship--0a00ca32-5ef6-4ec7-96a3-a78e47bd4cc6", "indicator--73695f1e-60f4-4c53-9fb8-6d5551cf101d", "indicator--666d103e-927b-4c6b-88c3-06a161e3238f", "indicator--88221bb2-e58c-485e-8055-506eec8af874", "indicator--8876b46d-1f9c-44ba-8f37-ea2317fadcf9", "indicator--7aed01c7-75bf-4b9b-b9db-785d71c1e926", "indicator--5dfbb1ca-b8d5-4aa7-94c3-4fa1511e8340", "indicator--e2589c8a-f8f4-4572-8a0d-4875e9507ca7", "indicator--a409a183-94c8-4b50-a39d-427d4abe8d86", "relationship--b3fe3b64-2736-4622-b10a-c5a90448e6f1", "relationship--aa45beec-cf8f-41de-91da-a59f1bc2c0b0", "relationship--050cc838-63db-4d60-91d4-838e0bbad2bd", "indicator--230ee2db-60e7-448c-95a4-221d7744d341", "indicator--dea6b652-982a-477e-861a-994067ddee66", "indicator--30674f96-16c5-4048-9625-ae229cd8b868", "relationship--41134026-0ee5-460f-a3b7-6421b87c1afa", "relationship--398c402d-2371-435b-a9c2-b9b8d2cdb90b", "indicator--af89719f-8880-4178-aa85-10ad42ba64e1", "indicator--d4389969-cd12-449b-bd7f-813f11972c6f", "indicator--8e123692-a7a1-4cee-9b50-936b132b4fc6", "indicator--d1a475f9-78e1-4736-b7bb-3190af9332cc", "indicator--ce0a09f5-5851-436a-a190-f0628d22465f", "indicator--c0020f72-d154-4753-b63e-96e8f82c879d", "indicator--15d1343b-cb96-4e7a-9b32-1da46721bfae", "indicator--b50757ed-4296-4627-aad4-d2208fb43366", "indicator--4e81cca8-0b42-46cc-b7ad-62dada502aaa", "indicator--0bd74719-21b6-4c15-8219-aa46733c949e", "indicator--8ec0a69a-b01a-4be4-93ed-2bccf6f36f60", "indicator--67f485e8-68ef-4400-ba96-4b3e3f7b286a", "indicator--d7d57430-1ff2-4552-9a4b-aaee20a38a50", "indicator--7932e44f-97c9-4a0d-9c3a-98b5a3d7ffde", "indicator--d9555c45-0dcc-4eef-9842-d7d9c75551cc", "indicator--77c825cf-9148-4706-adac-9f1e24f01307", "indicator--29b0205d-52bd-4c11-8c5b-7f73c69af994", "indicator--5127616d-5815-4c7a-86d0-25c4fefc2a34", "indicator--34988394-700f-4d1e-8927-8aa1291ce967", "indicator--2a87553b-2f7a-4957-90e4-b61861e6ca13", "indicator--2a640851-6255-4390-b142-78e12fc0a495", "indicator--143661e4-eda6-470a-a57b-545f19e084ce", "indicator--e093f31e-80f4-43fd-a1ca-a594c1e255a8", "indicator--d7a1f460-d5db-45aa-bba1-c99eb599002b", "indicator--5fd646f6-387e-42ff-b4f5-6c0e27c75882", "indicator--2ba46a5c-a346-4b48-8ab1-e78311039ede", "indicator--58e585e7-b422-4565-acfb-5e2c6ca0be2f", "indicator--54e62909-463c-40aa-bf0a-cc175d4c2f3a", "indicator--f87157e1-224b-475d-8379-a577c8f4e7e5", "indicator--bddb2154-aae5-4fe9-89d6-4ffadb4d8d20", "indicator--d46ac6cd-10ea-4392-af58-5c3978c71164", "indicator--f6b91ea4-2a5d-4fea-96a8-2b75eaab4bec", "indicator--58b2b3f8-960f-44fb-b617-ca56e03e8009", "indicator--445d7ce5-7734-4574-963a-7488ad85ce15", "indicator--4f7d836f-51db-465f-b5c9-ea52c322882b", "indicator--2afff615-3af0-491f-b75b-e85603caa4e9", "indicator--37ce18d5-696c-4460-b007-56898de00346", "indicator--b9f9f652-c151-4daa-b332-dcfcee62d8ad", "indicator--fd44c5a2-13de-4a53-9f60-f5ab63793d7c", "indicator--1d454510-8f5a-42ca-b44e-c3dc1e78958d", "indicator--6d8b3304-2b02-41f6-8f11-98eb661a22de", "indicator--ea5c98ad-a4bc-46cf-8dbb-de7b6f7340e0", "indicator--fbbc4432-4e79-41f1-a34c-35fc5d4129ba", "indicator--18ccf08d-8caa-41df-8d0a-95844ac8c224", "indicator--127f2731-1135-4f7a-a7b4-77a400687ec1", "indicator--65450d68-eb1a-4822-a9be-9af6f041bd4c", "indicator--9154c934-3db8-48fc-a5b7-58d340d98dda", "indicator--e5e27469-fa5b-4e70-bb11-c9f577997322", "indicator--3e23a47c-5d4b-4c27-9045-a11618629ad3", "indicator--8ceac63a-e26c-4aec-b0b1-ee48389c5f28", "indicator--0e3e7483-b0e1-4e81-b53f-a641fc970d9c", "indicator--5074d72c-ca8d-456a-9e3d-b3e3ab3044bf", "indicator--04979367-5017-44ae-b414-26b78757a21b", "indicator--eb7ddf7c-727e-47ff-a3b5-7c6d336741d4", "indicator--5b1a1a55-d085-46e3-a2eb-43a15b4413a7", "indicator--2dc498dd-7032-4c66-bca7-5050a39eac98", "indicator--788444cc-ee72-4f58-909b-8f6460c01e51", "indicator--f800c3b2-0df6-4eda-8186-38e8295d62e3", "indicator--04874ddb-a7ac-41de-9881-80098d33444a", "indicator--3952bebf-4aea-483b-bcd7-d853b8058b07", "indicator--704ce900-9103-4bd3-8821-59160a920bb7", "indicator--e2b62740-2902-45a5-ab43-034a182e20b6", "indicator--5efbb34e-baf8-42f8-97c5-a493975fffd7", "indicator--6cbd0cb1-ea56-43a4-9bea-51bf408af2f7", "indicator--c3ae58a7-faf7-4b19-98a5-1f5f1a4b5988", "indicator--247ec672-a5b5-4620-a25f-9ad3ef65e55c", "indicator--27f82320-8b0e-4e5c-9731-b10d47db6112", "indicator--563efd26-1aa9-48ec-acf4-b25d655829f3", "indicator--ade6c2ab-3883-4cd5-9b46-2279aaefe06e", "indicator--b3d848a8-52e9-4370-992b-737dda8c5842", "indicator--5ee04736-fa85-44ee-97b5-80ace4e64c07", "indicator--cf76e02d-8778-46ca-90ba-2b8f0f0dd27f", "indicator--d446b0e9-12bc-440f-ae7d-a8d15e71e92f", "indicator--8ad1d9db-a009-4eb8-ab23-988a54819e02", "indicator--ca1d0451-827c-46ed-9562-77089289c7ef", "indicator--e7f321bf-e6a8-4c7c-9c33-c9b7a183ea5d", "indicator--2d34a389-f52f-41ee-992e-eeac662f39a1", "indicator--b37292eb-e868-46ec-bc7f-f87b9b2ed86c", "indicator--54e962ff-88ac-4b86-980d-a9bfd000e0bb", "indicator--36450077-b21c-4d4f-890a-edc36b5e130b", "indicator--c734028f-ecb7-4471-9ecc-64cd91dea494", "indicator--edb7e667-6102-4583-a2fa-ce9e1c596bcc", "indicator--d211edf7-f233-45d4-8c72-47d98c6d8174", "indicator--8c866816-54b2-4351-9e69-f49d8c15cb82", "indicator--bf48d634-29c7-4d8c-9fb3-98eff2247604", "indicator--7adca3cd-3216-4553-bfa6-c451423b43bf", "indicator--99afdbb9-7d85-4cdd-8496-e7053bad327a", "indicator--ef7fccc3-cb4a-45fd-a747-b9d8aa74fee5", "indicator--ab90fff5-e9c0-4d2e-936a-196ec88bd121", "indicator--48467851-212f-4401-84d6-5a0f0f1f80de", "indicator--df6b280d-bc3d-4d95-91c8-9f12daa17a0d", "indicator--1ddfe239-4f73-4621-92a5-c709c8a74f6c", "indicator--39480def-bad2-4893-958a-9a7241944ab6", "indicator--fb497c92-675c-486f-9f09-2bef265d4b5d", "indicator--07295789-2906-4f59-b2d2-6d985ecda721", "indicator--86e983d2-cb3f-4f97-828e-163c08d35c5a", "indicator--ab5ea712-cacf-47c6-9d44-cfc891e79955", "indicator--f939eb08-2177-4018-8014-eb5b6f78b076", "indicator--70113332-a496-41ca-853f-5a362f850267", "indicator--e1248a5b-0a54-43c0-b46b-55e3a862e9c1", "indicator--f52d070b-e25b-49c3-918c-162eb4f05c52", "indicator--78d03121-388d-49f0-b29a-df2bf2e2d42d", "indicator--fa038353-07d5-4111-a456-6f18c894f461", "indicator--f6b7121e-994f-4d1d-befc-6ff7747dfbf5", "indicator--124db511-0f6b-47a1-b26f-f81aba3accc9", "indicator--6b3fcdd9-4ddf-43f9-95cf-a808f3e1dd4f", "indicator--d566f202-c1ce-492b-a4f4-41a7bf4a4aa6", "indicator--f055319e-8cc8-4d33-a6e0-1ac706d736a0", "indicator--b508d724-a69a-4ff9-9c1c-d64d53f1a046", "indicator--f29fde1a-bfe1-4af3-b098-047d8babb1ea", "indicator--73e11f05-a193-418c-aa17-446b305c8b41", "indicator--b70a0ebf-4ec1-4bb9-bd51-9dceac6678f5", "indicator--794c5ad9-8289-45f0-a9db-6c6b64608b86", "indicator--511f53d6-f761-49b4-97db-9cda24533c3f", "indicator--05523f57-164a-477f-be8a-d5ffbe07ff62", "indicator--3babc0f6-e9d9-4352-a79b-f2d6c26e6964", "indicator--69b93ae9-8149-47a7-945c-1249d3d1cf3e", "indicator--8a1d4bad-fcf4-4e48-8277-78645a0a3db4", "indicator--cbf53d0c-d41e-460d-b9ae-68de3ae41848", "indicator--a73c024d-1ec4-46db-bad4-53dd3a749878", "indicator--39343ce0-7635-43ef-b96e-f0718803be8b", "indicator--c289307e-2f95-4f4a-b04d-549e6105abc8", "indicator--a5afaddf-4c77-4d41-aa22-e22bf9cc7f95", "indicator--2182999d-4983-41a2-a2d9-9f7a7806713c", "indicator--9e22ff77-65f4-4d78-a2e1-96c14bca3677", "indicator--71d878ae-b023-41f7-90af-ddb5cdc2c2f1", "indicator--12f50b27-c19b-4a41-a218-0b732f385e1d", "indicator--6512fcdc-9fa4-4cdf-af90-0aff1687ac2e", "indicator--c41f0941-294d-4367-ac4c-9e5b1b67f28f", "indicator--758d3a24-9372-44d8-be0e-15adde34d27b", "indicator--fd92120c-7c93-4aab-a638-e82905ae6b0c", "indicator--0752448a-6bba-4a80-9fd5-6334c0c5d536", "indicator--6f290387-1886-42f9-a9c4-7fdb74f90b6a", "indicator--13cc5a17-df71-409c-9095-dd8c3ffe70ee", "indicator--c3daef11-7064-42bc-8486-2fd3428e1b01", "indicator--548ac1ea-115c-4373-9c0c-c142197b6815", "indicator--ce123f13-4c2f-499a-a8f0-aecdff1c06ed", "indicator--02b3790b-06a4-4f35-a0d5-00637aa776d9", "indicator--443ed0d6-a981-49d3-b47c-e93bdc68246b", "indicator--0c4740c6-c932-4d9f-bf82-b1a7f9543eff", "indicator--d49a25f0-5999-4f4e-8ade-7ff0e3c311be", "indicator--c496f97c-3773-4b20-ac2c-69a20b443c90", "indicator--f7c66d72-6726-42c9-9993-6c118432bd6e", "indicator--864ada06-230d-4bba-abf3-3039598937fc", "indicator--ab584665-77d3-48b0-8a5d-8fb3d8921b12", "indicator--d42a516e-2b68-454c-891d-88a59a630d80", "indicator--3ca0f212-4cb1-47f5-99e1-4a75e26eb5ff", "indicator--3adfc66b-2f99-49d3-93c0-ea6f328bf5a7", "indicator--0241c0fd-e515-4237-a834-bbc27f7179f9", "indicator--7e0dfa3e-aa50-4338-acd6-573c490d1754", "indicator--f275f2e2-c6f5-4e0d-9448-efc35c7c883e", "indicator--305e9726-ec3e-455a-b07b-e6b8f1cd667e", "indicator--76abe7e1-c0ec-4cdd-af8e-ddfede7746f3", "indicator--89b640cf-11f5-4a3f-be84-f18c632e6473", "indicator--e1f1f761-0726-4d9b-8dfa-e826bbe6051e", "indicator--6adbe88f-12eb-4f9d-b09b-f4efaf9791ee", "indicator--dddc66d7-7f1d-4587-9f7e-8a66561eb543", "indicator--2ac7e243-2b8a-4f81-97cf-d8c715c1ab7e", "indicator--c35277e5-e904-4576-85b8-0769c51dd325", "indicator--48fa3048-7348-4850-8aea-ccdf6f7b5ed2", "indicator--11533dca-a08b-495d-b7d4-18902f762b0b", "indicator--348ae482-65ad-4298-9b14-a56c1528ebc0", "indicator--3b524bbb-a3a0-44cb-ac4e-1ab2735884db", "indicator--4fa22829-cb3f-404b-8369-ebda431934a6", "indicator--b674007e-ccb9-4618-97b6-95e55cbfcb21", "indicator--795c5b63-be8d-42b8-8814-29b98fc3475a", "indicator--f3e2e7d4-d784-4aa7-b4de-bd2df46006cf", "indicator--23a62089-a4ce-4662-8991-b7a49e31dbfd", "indicator--ff1e15a9-5050-415b-913a-23818bd8ba26", "indicator--c1a3dbbd-5abc-41a7-9ab8-301b55e796c4", "indicator--ffede2a4-6ea8-416c-968f-43aece24d44a", "indicator--0c00a01b-ec01-449e-b76a-dcd78b23f6a2", "indicator--82c0dadb-756f-4aaa-8bd7-fc7158a06f9e", "indicator--692e62ad-86ef-4c17-9723-7dd7f030f785", "indicator--a7362135-7cee-4cf0-a77e-9b694feb0314", "indicator--aeca41ae-27f5-4e45-a89d-aa0307b657f3", "indicator--0b4524ba-6e9a-41f7-9304-35c3555051e8", "indicator--4d68804a-99bc-49f9-ae1b-a951f7722eaf", "indicator--514698d5-2aac-4dcc-9eda-dd9042eca15d", "indicator--e5c9cd55-1caa-4d6a-9116-a5b671388cf1", "indicator--45e03775-1bdc-4f8b-a1b4-3fc665e5617a", "indicator--c79cd3bf-2c36-4efb-a260-42cfc7118b75", "indicator--369c849e-a9f0-451e-8074-0214cb97936d", "indicator--17a97f16-4e1e-4f59-abe2-57538910eaff", "indicator--5f51b342-8760-4210-8898-e221712ef2fc", "indicator--e624d62b-8458-4e80-add2-692ada7bd5d6", "indicator--83c81c72-252c-4450-a4e3-d9b7004e7713", "indicator--2f4aae41-6727-429f-b7ad-1b3e9f7ed6e5", "indicator--e28e0197-610f-42b2-8282-a1ecb0af6f8e", "indicator--b22553de-88e5-4df8-9e9a-5a1dbf6415e1", "indicator--b6f4e465-5410-44d2-9aa6-5ab430967493", "indicator--7be96c85-511c-47bd-bb08-2b0b71ccad94", "indicator--f7fe363f-e4fe-4c53-b050-c99b4dcb5bf6", "indicator--8b32a28d-d9ba-4621-86c8-2d7ce3317b75", "indicator--f4f3ee37-8b3a-4417-8de6-fd1aa8d2a8e3", "indicator--02405325-69e7-4b4f-b4e2-a02293c1a0ad", "indicator--cd3b4c60-420a-4fca-befe-785dbe13b74f", "indicator--135a62aa-6569-404f-995e-e464d7bade86", "indicator--f247b3bd-2064-4a7a-94fd-727bcde3c94e", "indicator--9c675d3d-9e03-4a8b-95f7-d8119a1fbdd5", "indicator--14ad8259-c661-4d6f-8449-0a3b2e2e75aa", "relationship--11e432e2-7062-454b-bfa4-0cdaf5e59b34", "relationship--883f283d-4c9b-41f4-96ff-351a2e61f9b5", "relationship--28ac1da6-5c8c-4182-81b8-001080b0c002", "indicator--c7dcc9fb-dc61-4dc9-a93e-48d45106411e", "indicator--7dccd831-d642-49c4-b46d-ee561d471762", "indicator--631cb4c0-d2ad-4cbe-84dc-01e698edf57d", "indicator--2f3f0291-2baa-4ca8-9161-ef81347cb4ee", "indicator--b3810a84-bbfe-462b-93f1-9813cc2cdf52", "indicator--e26d7fef-f45d-4e43-9911-3e81b6612f5b", "indicator--29ad58f6-5adb-4bab-a368-60d68a26769e", "indicator--06533366-08f9-49e8-83aa-b94fcc997be5", "indicator--38d75ffb-af4a-4e3a-a796-20e231e2f003", "indicator--29b059a6-1a35-4e8b-bc9b-7a20e9221226", "indicator--13b9ee4b-aef1-4ecb-b978-e46281dade59", "indicator--e5ddc2e7-8f55-400d-a3b1-374547638c5a", "indicator--2fa9ace1-286f-4f8f-b76f-cb76054c40a3", "relationship--0cb4e959-c485-4763-a381-30277cdfe728", "relationship--53ab7815-4ae9-4fdb-9cac-4d6df10db559", "relationship--40f18943-0fdc-411b-9280-5be3816ca857", "indicator--aa33d9ab-053a-4dc4-b839-9d98cec4cf9b", "indicator--f1a271df-dfb2-43d8-92fb-2839c84e1612", "indicator--24bd1ad4-b100-4cf4-9c32-aaa4c47457ed", "indicator--4e15b60d-8957-415c-88d7-f0f2c6f42665", "indicator--547ce0be-1c2e-4e43-b1c6-512e37e50d8f", "indicator--fa0f5a5a-54db-42fb-ad07-30e9cf63c736", "indicator--d9582e77-c29b-49c7-928c-af4d057f3a94", "indicator--39526912-80d3-48b4-a8d3-d2782bf64cf4", "indicator--c9876404-23c0-4448-a02f-f03b8c0c87f1", "indicator--12ac7388-a367-4690-b957-e64fc4de7147", "indicator--4bd1962d-823a-4013-8a74-4c55666fdedb", "indicator--baae4fe5-40b7-41cb-8541-3ab33c6dad3c", "indicator--b10c2a9e-133d-435b-9623-548bb5f50f65", "indicator--d51835c7-2401-4b5b-822b-b18c68a23f65", "indicator--3c4d4eb1-e1d3-439b-badc-ae8a48af429f", "indicator--1c81a382-164a-4d00-b1e6-00940f171e3c", "indicator--228ba11a-b1ba-418c-9f15-dba6516589ea", "indicator--49ccdee5-6f27-4dae-a74a-59cfc7cd1e18", "indicator--b03de004-47e7-407c-8e2e-43e18dff44e8", "indicator--6bacfd92-b2e8-49ef-abf6-23cdeba3cddf", "indicator--7bd55cb5-ac43-4aa5-9227-edc8c791404f", "indicator--196ed3b3-74fb-43ae-9727-e8a8c012da1a", "indicator--c7018382-ef05-4bcf-bb1f-2f53ce179670", "indicator--24c9f6bc-6786-4ed2-86dd-e339c6eafee4", "indicator--22f23f13-a99f-4c5b-bff8-336faea451f0", "indicator--c33a12d7-bf64-47c8-886f-3e1d24eb1c21", "indicator--7e721a8a-b993-4c93-9381-0fff773dc5bb", "indicator--46912145-c78c-49eb-bfcc-9a812593f4ff", "indicator--ccd07e4d-a553-41d9-b083-968cd91cd24a", "indicator--1e6cba27-6c43-412b-aded-9f46aed39580", "indicator--0462df37-b51b-48b2-b601-b6f547af8311", "indicator--75228610-2aed-4adf-9e91-63813ecb5c0d", "indicator--d1dc4b4d-303d-4210-acb8-b857054d1c3b", "indicator--eebfacc3-d1c5-478b-8841-eaec0520faf5", "indicator--64d97d70-93a7-4075-99cb-c8b0e035ee16", "indicator--bb06dc9a-0f16-4787-88d6-3e2993d0846c", "indicator--2c020b98-84ca-401d-a9eb-223da8d0d530", "indicator--8b52f9c2-62a5-4089-8fc1-22108753e659", "indicator--dc3e75a1-cb67-40dd-bdde-1bde77940571", "indicator--996890da-4f74-4d1f-9d06-2cd418d19ad0", "indicator--5896fce6-51e9-4f03-a52c-46faf7b1936d", "indicator--09a2d9ed-9153-46bc-9e60-40989f24ee31", "indicator--4669ba6e-4700-48dc-8fa0-566673df6e7b", "indicator--bbe7385f-aa11-4b7f-b6f9-c7ad7263a9cb", "indicator--46fc8ea0-8105-48a8-a4ba-381632356578", "indicator--68cf0e5a-ad5d-44e0-a03d-fa76d54b9b41", "indicator--bd9e2c8e-ab4b-4870-ac8c-873e2b2c502e", "indicator--ecee3221-f25f-453e-9613-8a7223fa4955", "indicator--3301e2c8-4118-4e18-b411-c9b12ffcf5c9", "indicator--9ce3c6ce-77d1-4b12-8910-0f795c0e63a7", "indicator--101d25be-ca52-4fd5-a69f-10625cf71535", "indicator--2bea75a0-030d-4a24-b093-3143a682acd8", "indicator--fbc2cfbe-a145-49c6-9182-1dc322e3bbda", "indicator--f50fab29-9a45-46f2-900c-7c28154e5fc1", "indicator--ef98938c-5d1d-4815-9c65-e79f9c9d40a6", "indicator--bbbdbb88-b401-4170-8346-f51a905ae7ec", "indicator--cfb25fff-8c96-48cb-83eb-9e66170c68ba", "indicator--55205d0e-20bc-4b36-83b1-d1a5dfaedff2", "relationship--85a960b7-a27c-48a0-9fec-ece50bfd87e2", "relationship--7d0c43c0-d994-4203-b475-417574d72ad8", "relationship--7082e7bf-08da-4157-966e-0f85bb840925", "relationship--7007215f-7e6d-4c30-802d-7e4567b0eca5", "indicator--31c8b8f0-df2b-4095-a7d6-068387d52870", "relationship--dc384743-39ed-477a-b300-6effa8ea426f", "relationship--f4f258ef-912e-4c14-9889-689af855d431", "indicator--a9d4ccc9-2637-4cfb-9263-2efdc37f9e04", "indicator--15e3b607-c236-4edb-8185-d5f813c522f9", "indicator--24e62b5b-a3e1-4148-bc5d-7cee4b0e3fa8", "indicator--065b18c1-a0df-48f0-9697-fc5f6f37dd60", "indicator--33e98975-c216-4de5-b50d-5f6021d292a5", "indicator--c6297939-4ca2-4b28-aff1-e9afcb0281f3", "indicator--db4e43c9-5067-4771-b8f1-d552bf71c145", "indicator--94cf1e19-ce29-46cf-b154-5ab3cc882793", "indicator--319cd005-c095-4d9e-8202-86f3855d0fe8", "indicator--4e29502c-b516-412b-957e-3507473c4ee8", "relationship--3baccdb8-c805-4354-91a5-ca52e0fc404b", "indicator--0e65045c-7400-4f15-a772-493075bfc521", "relationship--4a3a699f-e478-43d8-9b87-2b741bfc6a7d", "indicator--c78b42ed-8b9a-4c8a-ad02-5737c4310f46", "relationship--fbbec4c2-b90a-45d4-b8ad-2b1a3adbb61a", "relationship--f78eef58-ecf6-45b6-a2ee-da4397a27699", "relationship--3b91e36d-69db-41c1-8051-314007f7cde0", "indicator--3b53718d-e9a0-46b8-93d5-ec069014b0bc", "indicator--8ccdfd75-a8ae-4243-8ca1-c134b964849e", "indicator--5f8ff1b0-95f7-4137-aee3-b02978aa8829", "indicator--51532187-bf63-4563-a16b-0e7911784499", "indicator--39e73e67-9933-4435-bf43-d565c84c827d", "indicator--8477282b-5968-4816-821e-6895e4afc464", "indicator--4c759204-f826-4d6c-a66d-37263f8336ef", "indicator--312ed4c1-b6b4-4465-910c-4157c844cd21", "indicator--ef15369b-d3b4-4834-bd6a-b7188174b581", "indicator--bbf80c23-beda-4214-984a-9c5c98da5f5d", "indicator--57e9a2b4-d361-4c20-a04b-d3abd3f81fee", "indicator--782d52ac-69a2-45af-810a-61120b75e185", "indicator--24e7a5c3-1f35-407a-ac98-e082aa6b877c", "indicator--d94467de-8da4-4652-a87c-a69a5bc33b8b", "indicator--6f42c210-92fd-415a-9655-502502fdfd5c", "indicator--8c624ead-50bf-4b78-bc10-e2b686c17b8d", "indicator--ed7e6b0d-fca4-4b29-b706-b43c4a0bef6b", "indicator--d770bb4b-1430-42c6-a909-554ce63ce2bd", "indicator--da4cd951-1287-4778-9191-b733997451d1", "indicator--5f173d6a-d67d-492f-878c-32004258bdc8", "indicator--624a527c-0cd1-48c5-94d6-1010e39eb60f", "indicator--a90732dd-db3a-425b-998b-40464102042a", "indicator--a52ec7a4-cd68-4b03-bdd1-1af56512b639", "relationship--49bbe6b3-7386-4253-8622-672d95f0f50b", "relationship--e0b495af-a492-47bd-aead-c47169c7027d", "relationship--fec85b3c-ef40-467e-99fa-831b933ab073", "relationship--1288e145-51fe-44d4-b0ea-0be1c6b2c2c6", "indicator--7a6c3c07-4632-43ca-9f81-6c41919737de", "relationship--f64b4315-33da-4b90-a51f-1b43a8b763c6", "relationship--df5ecadf-3502-44b9-879a-fdceed721ef2", "indicator--1147aa07-6626-4658-8a6a-889f5d31e9a7", "indicator--737d9ed0-4b35-48c5-8b3d-6e143ca2c266", "indicator--31f734fc-c950-47a8-a6a1-81fee5c2638d", "relationship--81d9074b-ef30-4706-bf8a-be7ece4817fa", "relationship--f9b11e43-283d-465e-a9d5-ae59aad5f578", "indicator--dc1d888d-77fd-4891-a10f-f5e48a3b4976", "relationship--e864f5a4-0ed4-44f0-a8a9-9b61e02e59a7", "relationship--35c22860-e30e-4f23-ae41-fb95926d8d86", "indicator--bdfa5093-4c50-4483-92c6-3d23db1a3284", "indicator--618432ea-2137-4fe1-9e53-fbef2a5baa18", "indicator--0336cf7a-7c81-4b21-9e4a-dc1886ddaa45", "relationship--badbff7b-e3e4-4015-97a4-14ddeaeebb48", "relationship--a1fe6524-4cc8-4422-90ee-a8420fcf8e05", "indicator--6f10cf7f-bd46-4de4-a35f-589b3b88e458", "relationship--d1540d01-7f95-4b97-a099-70acf5f3406f", "relationship--501d322a-5aa6-43ce-9a46-944237311660", "indicator--5e6968a8-9633-4e73-85a5-caab249065d0", "relationship--a42fc39b-3839-4c06-a363-417fa45f8351", "relationship--efa2d6b1-c27e-4b1e-944a-290468fb9e67", "indicator--9dbb6396-cecb-44f5-9389-3df5dc182d49", "relationship--e0bfaba6-2a1b-4a52-9646-12a305df392b", "relationship--63933ca4-fc5b-4d5f-b227-c5225df88e7e", "indicator--5e98863e-604e-4d91-8366-fb6a39d66c2a", "indicator--df3f04cb-b2c1-4c59-ab74-4e2ff5547819", "indicator--cd604ccd-bb03-4cf9-9b91-5c833e57d7b5", "indicator--6076f79f-516a-4e9b-ae63-0684c92eeef3", "relationship--59c7a7df-70fc-400b-bf9f-e09faed1da7b", "relationship--d7c41ddc-9cc9-4c1c-a34e-19a0269d3a16", "indicator--f8db2fc8-b4ec-46dd-bea4-21d1749e75a4", "relationship--cca10916-ec0f-4f72-a0c0-e7ee91e22ab2", "relationship--51322d08-abe6-491a-9d11-dbad5aa68b3e", "indicator--c864f726-11de-4237-83a1-5870ac8c95bc", "relationship--12e20880-f3c5-4aed-9f32-3a3cff98df35", "relationship--5d724c31-1367-4024-b457-9721d24f065e", "indicator--800a5379-bd37-4186-938a-edb91c80134e", "relationship--c31da74b-b2d0-4740-8270-015c751a4e6c", "relationship--8139775e-bf85-4a18-a157-4983b2cd4c6a", "indicator--ae26ef94-c75d-4618-b86a-b8be2609640c", "indicator--38cceeed-f9a3-4142-9870-d60a69f466c7", "indicator--2b9bf0df-8706-41c9-8aba-eb9dc73af8b3", "indicator--ec3150bb-30f8-4daa-8a52-e8a93613e925", "indicator--7dcd4594-4cf7-4261-a6dc-1fb530e97820", "indicator--dcf12ded-93b6-4bd2-bd60-a60d9de2346c", "relationship--dd5c76c1-742c-4ab7-82d9-7b2b5a316285", "relationship--81e2c3f9-b09e-47a1-b771-0d6f98431134", "indicator--00c03ab5-d4dc-49bf-8580-afc79090e711", "indicator--d1710110-6a9e-4427-8a28-e8246647c53f", "relationship--cf6f08d2-6d8f-46f8-8ed3-228ad5e7856a", "relationship--5dcb81a6-49da-4f34-92a8-3859d0ada4d7", "indicator--a8e0ed95-cea1-4d48-b2ed-4abbefebd7e2", "indicator--924c64f7-d92b-4a7a-8f2f-0ff9ebd01ca6", "relationship--6fc295c9-c63c-4a37-8149-1d55c501e723", "relationship--b6860737-4e4a-44cb-979a-2fb89328889d", "indicator--cb5dd83c-7069-483b-ac14-8a76294bb59f", "indicator--9e78f342-7799-4922-a5f0-56a7bd86c7af", "relationship--75880b64-f70b-4414-ba19-6eb2fd9271ad", "relationship--4c5bf13f-c2fb-4403-a1cd-b72664df5e0a", "indicator--7cb15031-2490-4a8f-a133-16724979b187", "indicator--44bb4fc3-4720-4fa6-9b7e-a9e85977216a", "indicator--3298ac35-5ca2-49fb-ab6c-b7e69112ff18", "relationship--7f87aa4f-9ab1-4080-8f26-dd400a649865", "relationship--02f0cc17-94ed-4e8c-a154-14474ffad6bd", "indicator--9f33e59b-9ff6-4634-91d9-62b3f0b28228", "relationship--a24a5a7a-21da-4fc7-a71e-2a257b406a82", "relationship--885000f0-2ed2-433e-967b-3ef1b9740e7f", "relationship--319d2c8a-5184-4bf8-a55a-4566e7a3d917", "indicator--db022c33-7688-44d5-8b26-c4feb549f45e", "relationship--53515600-e2d3-477d-9801-a55553fbc217", "relationship--03d24d13-2aa3-4038-9372-43f0792d5552", "relationship--bf020cd7-91de-4f34-b456-3908956d1e3d", "indicator--52b5b84d-72f6-4347-94c1-f413809fda7d", "relationship--d6b36c3e-1e37-4498-9625-306b9430a395", "relationship--b6338de6-6422-4e64-b684-267be9245b0a", "relationship--7adb18b5-5c88-4f12-b851-73ab7608be91", "indicator--54d21dbb-20a1-4ae6-90c6-d55107ab685a", "indicator--ad6ad65a-a219-4c9b-a526-03c0d6dff073", "indicator--713533b0-2a0d-4ed2-92d0-9e51777b12f1", "indicator--06b84e7d-565e-40f4-845d-ed5614b52ed7", "indicator--662ad891-fb31-4078-813b-ebef6489396d", "indicator--6c97393e-8c8e-4ff9-943d-99c37674d084", "indicator--f43a480b-c3dd-4515-b8da-7da61c69c056", "indicator--d59db5e0-9e6d-48c6-8aba-4469bbbc1f15", "indicator--809db237-c173-4514-81f5-ea997ca303dc", "indicator--c9968fbb-ce76-4316-ac24-29cf31b69c39", "indicator--cbc09f58-86f4-4998-8d68-c02e4ee80928", "indicator--bbe62e76-985d-4c15-b70e-1b67d4e79507", "indicator--15c6f294-3a2b-4e5c-8946-4ed1860d74b1", "indicator--0457413e-b94f-4e28-852d-f999de4d5135", "indicator--4bec4f9f-be23-44fe-bcc0-c76968a7720d", "indicator--7e889f01-7b44-4232-a943-00a7fd7050e1", "indicator--b5f49dd8-0638-4fc8-a221-864d40919e0e", "indicator--1813845b-d1f1-4e2a-8208-519d4e3908ab", "indicator--f97057c7-7a7a-49d0-bef1-2fd5181e878b", "indicator--0f1ae6c4-f336-41fa-b55b-0521df9d1125", "indicator--e19ca9c2-1965-4331-ac7b-5e553180bf62", "indicator--abe07724-eb9a-4490-bf05-3ea9aad4389a", "indicator--507bcd4b-451d-4059-bae3-79eebf940fea", "indicator--b444f0b3-8cb0-41cc-bc64-11d4db376d6c", "indicator--1521f72b-0871-4123-97ae-082f9dc75b78", "indicator--ca207c6f-d3e2-4ffe-afec-123441b21d7e", "indicator--7db57034-5c37-4aa0-ad0f-eb49558ca155", "indicator--d0a29bd0-fd03-45e0-9c4f-c9b60b53d81b", "indicator--9554d10d-9939-4c72-9aa5-fda296bde6f3", "indicator--d2d43d13-d1bd-4607-aaeb-62b43aa17700", "indicator--625825bb-c852-4468-92c8-2c42b2132df3", "indicator--c87175e7-384c-48e4-a78f-0c629cd2a4f8", "indicator--0bff41eb-cc79-4f7d-925b-8b4eee87c992", "indicator--950090fb-be00-40a8-b93f-85a600213571", "indicator--a07bfc23-b936-4365-ae84-e66eac2c893c", "indicator--291d13bf-932e-4c29-99b2-31652077c3ef", "indicator--04824ef0-1ca4-4fc0-9f50-92b96939cb10", "indicator--7d6fed61-b45e-43a0-977a-fa52e7b2e9aa", "indicator--1c836827-cb29-415f-9fb5-145f13267f3f", "indicator--dde5a092-a020-432f-a845-000985bc2608", "indicator--1eb1309f-ab37-4bc5-bbf8-2b5736fbc026", "indicator--8de2c4bc-ab5d-4ea0-af1a-8e233cd05cae", "indicator--84443e5f-92ba-43f0-b472-55ebb50f25ab", "indicator--2d2f5fb3-7cb2-4bda-847e-12b04520bda8", "indicator--6e8ac16f-89f9-42c4-9539-48c83f336530", "indicator--d47757ba-bf6c-4ecb-81c4-638454013bff", "indicator--0bebe372-2946-46de-b595-60ed4aeeb063", "indicator--cfd60f0d-cc27-4402-ad7c-6626dd04c16e", "indicator--a6051165-bf7a-4fc2-9713-ef40a765dc8c", "indicator--e6483919-f6a9-464b-b431-283b7919ba76", "indicator--04c52b36-4b69-4f33-9f40-0a6b1f00785b", "indicator--0629bcfc-7b33-46a6-9e94-f1ae1e633924", "indicator--248ec13f-27e8-4ea4-9a7b-d07549ce007c", "indicator--3c4b0023-73df-4c9c-838c-82e2e7c02aee", "indicator--fa4d7740-d58a-4745-a0c3-f7ea6f58ffbf", "indicator--83d62693-8b9d-47d8-bc08-a2838e94be08", "indicator--f8e9a2bb-6505-4123-98d8-d26691c13ad7", "indicator--2eb72400-e3cc-43dc-8035-748fdd91f8e1", "indicator--0966484d-878c-4074-9750-fce41172a896", "indicator--fa05a118-e2ba-4055-8c1f-76cc087ac623", "indicator--28d9c83c-cdaa-4842-af6c-8e457798868b", "indicator--3939bc3c-3386-4608-9f7e-467af5c15ded", "indicator--5f2821e2-2f3e-4fab-a152-f1bb882fc976", "indicator--25d5ba0a-74d2-44df-bfa5-91219a6b2a3c", "indicator--6371ee57-21b6-4822-8f7f-ceaf6fab9188", "indicator--9a0230a6-cab4-4a03-af1c-8e57352fae31", "indicator--98701eb2-eb68-48f0-8425-43009f0f1a4a", "indicator--fa0fbd07-eadf-4ea3-9def-355951ba292e", "indicator--172dcaa5-a53e-46c0-8aa6-c6108a683553", "indicator--d5ae0421-f746-4aa9-8687-7edc3cf5247a", "indicator--b8fe7795-ff65-4f0c-8be3-d041fe18f51f", "indicator--dec0bd7e-18ea-45ff-a242-d3ca5c4a0997", "indicator--ff33bc89-3c9e-4077-b237-8df4cfcfdcf7", "indicator--a3960298-5a93-4c43-a6f6-79a65843caf8", "indicator--6907cd88-8c10-4a69-bfe4-7f20f264af4d", "indicator--7a1cbcec-21da-4821-926f-6c5b5f109951", "indicator--53ffad11-ba61-40e8-a09a-41cad1cc677d", "indicator--31d7eb82-0656-4763-955c-56f252f7acb7", "relationship--e774a2bf-3a49-4507-8a4d-3817f90d7bbe", "indicator--2c544ef0-84dd-4344-a80c-b35107febd27", "relationship--c08f177e-6069-44b3-a8e2-e8d0ed9ec989", "relationship--14c0fcfe-b6ff-4e3a-9a32-3be9e5da2fd1", "indicator--6e2a0f85-1081-4f1c-906c-ad545e0dd486", "indicator--5fda814f-8046-4ee2-8d2f-c41484febabc", "indicator--30cb9cee-7851-4a33-b51b-156acc6566da", "indicator--5c51a677-e834-4166-ad76-847934900709", "indicator--3cb36e4a-b63e-4c7d-aa67-e6009de4fb11", "indicator--ac1652a7-9037-4f71-80a2-1b948af0b30b", "indicator--8631be58-8110-4a54-bab5-c58eec2746e9", "indicator--7dd9e2f4-e4b2-4d6c-93b3-5d45bfb012cd", "relationship--40583a56-f5fd-4f99-88e0-69fdadd73f02", "relationship--354554ea-b930-4bb1-8e7a-db5d5c01bad2", "relationship--f91f2b89-891a-48b0-ab80-c79e50c20d18", "indicator--a8a9c0dd-145b-4831-9de9-1476ee71da83", "indicator--0e2f8f29-ba4a-4a5b-8a28-305414d37edc", "indicator--d7991fe5-1cf7-417b-a181-693363e59c5c", "indicator--d9558f4f-16f1-4ca8-86c0-080504ef4665", "indicator--6745062c-15d2-4994-9576-6a0272dbc74b", "indicator--a06994d3-6471-4ca3-9216-67a89a53fc58", "indicator--66958272-965b-4cf0-93ac-7a6dd1d398f8", "indicator--6035f184-d327-4731-b840-7576782d2eb5", "indicator--f363b887-923e-482e-bf4b-d9941bb83776", "indicator--4bf84035-c24b-47ef-bd6e-32956b683275", "indicator--bdca2a66-e77e-4437-ba0c-4e4a9219bc41", "indicator--beda0b8c-2ee1-473e-be4b-17a9f9bbc7db", "indicator--481ca6db-d4e8-446d-81fa-eb0179f409c2", "indicator--e880bbc1-14b1-4c5e-8db9-8cbfaa22b068", "relationship--1e3e654e-0d36-472d-b845-b9090d0a2ffd", "relationship--29051a49-8bc3-43f1-b5b0-8acc1d7bf602", "relationship--f20ed681-f4d7-4e10-9737-e1cda1e28984", "indicator--6514c7d2-4728-4b4d-8750-9002fc0d459b", "indicator--443f97a6-9635-477c-8d18-02cee3b3a7ce", "indicator--56dd400c-2acc-4b23-a091-0dc3af5cf057", "indicator--10d04500-7257-47b5-843e-602f4f038a0a", "indicator--9a87cc60-dd5d-40d7-813c-e893c2dace9a", "indicator--cbfc63cc-583e-4eba-ad23-aca5d23ddaa2", "indicator--a1e3b1c2-c79f-4e2b-a1a2-b7126b91b53b", "indicator--240a45b9-727e-4e33-89e3-92d40b6a0b9a", "indicator--de1dfdfe-d8a5-4acf-a29a-7342b176add7", "indicator--1f646238-4513-4d79-a328-acb742f84cc1", "indicator--96df7a30-2c4a-4f0d-8543-274566e6fb23", "indicator--f38f5c71-a992-4c67-b29d-b7dc3b3023e0", "indicator--24617e1f-cda2-46d2-9c0a-1fd5ed6c2ed7", "indicator--3cab08e8-327e-4393-895f-671cd37d2d40", "indicator--6dd1a83d-7e32-4ebd-b320-b1079d998ed7", "indicator--fa6cbe2e-61b7-4b31-b5b9-6ae7888b8855", "indicator--c22dcd6b-3221-4a42-908f-a543e19b7fdb", "indicator--5e6651e0-3c2e-490b-b74e-1dcf2bb2bfa9", "indicator--600c110e-7b47-4ebe-a619-7ab66b59d963", "indicator--d88a7990-c8e4-4019-9456-1b78a50e1975", "indicator--4edc68ca-6c0f-4ab2-8c89-6e0691d87411", "indicator--00c96615-da60-4172-a75c-6b123840a532", "indicator--c7e93db8-010b-46a2-86a6-195b9fc4a487", "indicator--e981895f-f088-4a49-85be-6109f4e9a365", "indicator--126bbaad-5254-400c-85af-68a85b15b41f", "indicator--c5ac0dd6-1822-4dac-a9e1-4c2bdf0f670e", "indicator--936514f4-7de1-434a-8dd1-043ae4ea6cdc", "indicator--1d7557ec-5d62-4075-a15c-12c806aec621", "indicator--303d9a71-359c-4c52-9d49-fcfeab1f832d", "indicator--8355af5a-bb81-470f-afc2-7e796b8bba09", "indicator--549a2b40-a770-49d8-845a-4e85cbd8971d", "indicator--ad2e37d2-d1ca-4203-92ca-50d0eeefc255", "indicator--ec3a638e-0781-435f-b862-d5da310c9a6c", "indicator--8973c72a-987c-4298-9a90-794f069cc101", "indicator--c4f24989-fd1f-43d8-b6a7-a744c5c82f5a", "indicator--a01c7556-7ea2-4b6c-920a-701eff2bfea2", "indicator--43460615-245e-49e4-903a-71192c5b778d", "indicator--71f8ec98-ee56-47f0-89ae-01600fcc49f0", "indicator--3f18a322-7c1a-4058-832f-2c5734f46af2", "indicator--9e9d42c9-ad92-4203-a396-54432996a76c", "indicator--fb659d5a-445e-4e44-9571-3c56519da0da", "indicator--18d45d48-3947-46ae-831c-ff0e2c8a0bb5", "indicator--7c45ee5d-b5db-46e2-9879-1eee9b6d9d35", "indicator--fad0b0a8-6bbf-4cd1-a957-2159309a638b", "indicator--b3d836b5-25a8-4c68-90ad-669a469c1586", "indicator--6a0259c5-816f-4aa6-a2f6-3673ea3243f4", "indicator--c4cecc52-c560-473d-b346-9c5585060024", "indicator--736ce219-a83a-4f70-b67d-7279c7d5e04c", "indicator--5382f53b-f385-45cf-9f3d-8d4e66acf299", "indicator--7a2a2d8d-a0a8-43cf-84da-a94dac250ba6", "indicator--4ed3200f-2348-4ed2-8033-92907d4359ba", "indicator--6bd0faa5-3f1b-4d1d-b199-a9b3641b81c0", "indicator--a4f14281-a2b1-4344-8edc-056d03321560", "indicator--54bd5eda-32b3-4f31-b131-497e6cd7ee5b", "indicator--9c787f0b-cc9f-4247-b65d-0162bf00fdeb", "indicator--8cf6044f-0d93-4fe5-af40-5f1f6a865c4f", "indicator--f14a46c8-fd73-4558-af37-1707414b0f4d", "indicator--f6515007-2f7d-4bf9-9c02-679cbe4c378f", "indicator--a5b6b19c-f307-415f-81c8-3e865582d51e", "indicator--4008649c-698c-46ba-a059-46a1882cbb72", "indicator--46bb7705-709a-4b4a-a000-2f4d228efb23", "indicator--902aa625-76f7-41ed-8f23-53c5498ffc76", "indicator--17effbbe-5451-4b90-a637-39fe40e26f51", "indicator--70d328a8-0898-44a0-9a74-f919571856b1", "indicator--63ae64f7-f346-4cb8-b354-3b2d6f4d9e1a", "indicator--ec14b4a0-833b-40d3-90b5-2ab7c696fe43", "indicator--e9b3064a-a2e5-4b72-8b73-d525efce2c0f", "indicator--7dd72e1e-925b-414b-ae12-51a11743c0e9", "indicator--abf5fa83-5562-46bf-80c1-76796554cc5c", "indicator--f444dc2e-c446-4136-b16e-da4746fea35b", "indicator--2ea5503b-3dcf-4346-9c39-5b2421553902", "indicator--27913063-3b9d-4a12-9bcc-596ffe974198", "indicator--b7e6f8ea-81f1-484d-ba6c-6079d70e3c2e", "indicator--b71a2930-b85a-4872-b58a-75afb383b976", "indicator--9309a27b-012d-40cf-a25c-4fbdc51a359f", "indicator--edd4f252-edc5-4586-b62c-1164f714fff4", "indicator--ce72a666-ba0b-453f-a949-bd9836f2131f", "indicator--0e128cda-9d3f-4323-9a75-d2978864c396", "indicator--d5c500a4-e565-4943-aabd-e2c8d0adf0d1", "indicator--5c0889d0-2e77-4227-b51e-e5a92e0d2ab4", "indicator--722e4dab-cb5d-4000-8acb-25d9351b2127", "indicator--e1af9326-66df-4c3b-b91b-9703268f6d6c", "indicator--960ac4d5-1327-4efc-8905-1ba9e285fdae", "indicator--d1fa120d-5cce-4641-95a6-8d07ff9f63dc", "indicator--6bef82b4-a8c1-4120-b2dd-e4fae5c146ec", "indicator--5b564937-22d3-4941-9a19-cdcc15963a5a", "indicator--734bbc56-34d8-4f73-a1d8-8d925875b3d9", "indicator--587be777-de04-4452-9c0f-03131f0f45bc", "indicator--a74d5828-001d-4fa9-a168-5f4ae39fd3ca", "indicator--aac18d73-4b59-4b52-9470-3f361b23ee58", "indicator--e998fafd-d0fd-4e0d-a315-af101945ff3a", "indicator--17d8678a-9114-43f0-b3d6-a72383e5a242", "indicator--9c6e896d-0c61-4d8d-8f56-885e4bd21dca", "indicator--5313dd7c-1971-4fa2-85cb-802c5a313b0b", "indicator--8207014b-edae-4bdd-94cb-4d97b4d2200f", "indicator--c1298424-6185-4192-8d71-ac6eb99da377", "indicator--a0b01d77-eaa7-44c2-80f7-509c9cab6076", "indicator--1c8c56c4-fcf0-4f29-bf1e-4b317d916499", "indicator--c4c82b72-94fd-459e-a419-9bc067ab9c39", "indicator--e145830b-df83-40f1-a3f5-6be75e48d91e", "indicator--60db1dcc-04d4-4685-8f36-a5ac20a9af1d", "indicator--e276d8d0-d295-41aa-8530-f7b0ba3e1aed", "indicator--7dbd0efd-9ff9-4cfc-b955-0d55cd42dbe6", "indicator--01bcece5-25cc-4f54-99e3-eacbe8f78e05", "indicator--493f3579-6cab-470b-94f9-7bcaa02aebcd", "indicator--ed40f5c2-41a1-4cf5-bd33-3efe7df612c4", "indicator--e8632f3b-a75d-4857-ab8c-11c2b6fefd0f", "indicator--17598e4e-0651-414e-a07c-37cb5a07a58f", "indicator--42b2c18a-4618-4133-91de-d298c4aac681", "indicator--a4039bce-e70a-4132-81c6-cafdcc1ca8f6", "indicator--663f33b9-5972-459d-96c9-f3078a0b208b", "indicator--93ea6420-6816-4656-94ae-51f1a48e17e6", "indicator--66e9b636-6958-4e09-81ea-efc8761ea533", "indicator--cdb745a2-5b1f-422a-9b0e-be226dd73a60", "indicator--fc421d7d-ee5c-4ed4-8a79-4bea5fb98b5a", "indicator--8a0480eb-4b9e-4ed4-b95d-08b05db6aeae", "indicator--ec4e40f5-2452-469c-971f-d920c9b36ef9", "indicator--c7dec1f8-4827-4001-83fc-87d0d3ede9b7", "indicator--e7f19adf-9c17-41b6-9613-3184dfa6d2fc", "indicator--dba7cfd5-f866-472e-a3ed-7971f373b5b4", "indicator--48102b12-d2c8-43d6-8fd6-a68df20b2dc5", "indicator--bc8bada5-d698-458f-a5f7-663260cd5049", "indicator--cc9483bf-11fd-4458-a744-e28d863686e3", "indicator--86b9e665-9b8f-42b7-977f-1906432ec747", "indicator--4f273109-8fc5-4e74-80a1-948e3f6ae6a2", "indicator--ad6f38ee-bafa-4476-a9cd-14b8049da61d", "indicator--27a5cf16-5395-40b1-af0e-f13ad8701ca9", "indicator--a32b7ebd-542d-45b7-b13c-74a1721d5bea", "indicator--ad489a80-b918-47df-a422-dc9b385e0bae", "indicator--8a95d342-337a-4cbe-96db-7dd353914c25", "indicator--6f0e40a4-377a-4ec0-bbbd-630be0a95a39", "indicator--616a4735-8cbe-43e0-9dfc-97ae5407adb2", "indicator--d7c491a2-f6f3-48e9-8622-cc6045c94b8d", "indicator--041f0b63-0b91-4390-8837-39c06fc745f3", "indicator--3e5d548e-d0ab-4f0b-8e9a-4147aeab2baa", "indicator--48809359-0fbc-4a12-8983-c321b66ccfd6", "indicator--84f7497f-8b25-4c96-9952-b7099e077fcf", "indicator--e300c77b-cfbb-4c4f-8e1c-f95b5cd83c15", "indicator--b32c7f92-1b3a-42cc-9df1-620da78dba34", "indicator--8646d4c9-a294-4583-837d-af0833403e67", "indicator--52c63502-bfc3-455d-adeb-abcb3a73a9a2", "indicator--c4c20f5a-7674-4687-9580-961b33e0540a", "indicator--acd104ee-c034-428b-81bb-29eb29ff4612", "indicator--399c29fa-79df-4b02-a361-2e327230f5b2", "indicator--fba2ba13-e2a2-40b4-a958-65a969b75c08", "indicator--d7edb48f-2001-4814-910e-d5f4d32c98da", "indicator--af038440-341b-4605-b129-b37820b44e7b", "indicator--348c3e3f-7131-4ff9-826d-a0538d0a422a", "indicator--65199216-19e3-4f0d-9aa5-3f8fe19b4231", "indicator--7db9f110-4166-47a3-93ec-fa49e52ed862", "indicator--57ed8d25-5246-46b4-8ca8-4299e7f25b38", "indicator--d6e7282a-4fa8-4543-9c4e-4db396eb6c51", "indicator--65310fb4-798a-46e6-b2e9-7fca58e06dcd", "indicator--363c99da-3a3b-444e-add8-b923cfe90838", "indicator--246c787f-4bc0-4bcb-aacb-859b388e2bbb", "indicator--a473ac1a-128c-48ff-925d-77cc6fb5cce8", "indicator--2ff2d538-6e9c-4306-b71c-d04f4393333e", "indicator--af3423be-a2fd-487b-a66c-e17a794f64a2", "indicator--14a149ed-4892-42a2-83cf-f1702f621aef", "indicator--d2941b2c-661b-4c86-950a-8cd7e5ad91c1", "indicator--1034f19d-3c31-42fc-a47f-165452bdcfb9", "indicator--6a71af3f-9f84-41a0-9c75-4af65053fc98", "indicator--bcef7f0e-07da-4b60-a893-b03ac1da7fe2", "indicator--60ea8249-837b-4f2a-b1f2-b07583104bf6", "indicator--68832095-7225-4da9-a0d0-bef757abd634", "indicator--9aa1e85d-66bb-4990-978f-dc93b9272063", "indicator--56c303d8-abe8-444f-ba4d-24a03435d085", "indicator--714f4dbe-375f-4000-abcc-ce202e262011", "indicator--21a1e2b7-150b-4131-b9e7-51cc56f63859", "indicator--ee2e22e6-d214-4bbe-8a38-ae61d75228e6", "indicator--7818e279-afb0-40f0-ae34-dd266733afbd", "indicator--69338062-5fbb-4511-b5d5-70813ca2e0ff", "indicator--4f765fe5-95eb-47d3-af55-ff817881975a", "indicator--046bfe0b-71be-454d-a89d-9d5be4820d92", "indicator--b4aef7a9-7512-41d3-acd4-6deca9d9dc7e", "indicator--2d8d0026-5cf7-428f-8c42-03d820b4db8f", "indicator--13c1bd49-8718-4af4-bfd5-aa7a8f9d94b9", "indicator--87807bf1-f7a7-478c-9cab-8225af91e390", "indicator--ed982f88-5cd3-4448-afa4-8105db4c15ec", "indicator--3e545ee2-ed7c-4d1a-aa77-b0b2ae058d73", "indicator--16c1253b-c7a2-4d22-87ae-17e085bac032", "indicator--0cff831b-94b9-41b1-b815-c18133901e4d", "indicator--89b956d4-acf6-40f3-ab5f-dfeaf2c8461c", "indicator--3df93ed6-5332-48c6-a804-0d6910e99e62", "indicator--911c238c-11ef-4983-9495-60e6c2eff364", "indicator--b666d482-7d33-46d1-86c6-45e741662bd0", "indicator--98fa08ff-5328-4649-a887-e390cbe32388", "indicator--c208a117-8598-4226-90f8-8eb9c62f474f", "indicator--e8776ba9-5372-44ce-b71e-7e2525f3b688", "indicator--8a99723c-489a-409a-8b65-9ab2f300f166", "indicator--cf9fe896-804a-4f4a-b353-824a3058456d", "indicator--0a428ee6-6158-49f9-91e5-e08b1143a719", "indicator--6e96a5ea-b384-4925-8e0f-cc07abc4b409", "indicator--6ba4dbba-0044-4cf2-815f-1000970091d5", "indicator--4b5df7f5-5a7d-4c86-a43b-53023fcf73dc", "indicator--532f01de-9a99-4dd6-8be0-d061797c6f38", "indicator--63099576-1f39-4558-8594-c1257c5bee2c", "indicator--c8a2c316-5c67-49eb-bbd8-f9f6a9c349f0", "indicator--3a125fb4-67f9-490a-88fa-7821c6be69fa", "indicator--7f260687-8574-4aec-a79b-b26524dd6cd2", "indicator--6003f4f7-d8c9-4825-9e26-ef38f4ffb23f", "indicator--3613e015-6e49-45d2-9f6e-9daaea108735", "indicator--e77f0a68-8618-4af9-b7fb-f63e69f2004b", "indicator--627908fe-15e9-4949-94a9-10ec28a98335", "indicator--f1a1dbe3-078f-4963-9d75-49df50a1b18a", "indicator--1dac47e7-5c0f-48ea-ac93-750f1bf76321", "indicator--2b83b284-e5d1-423b-8c94-aa8d2e982bb4", "indicator--fb368205-72e2-4f98-8679-269e70141047", "indicator--513bd9bc-52f5-4463-b914-2c774931fec4", "indicator--ee288d35-32dd-41e3-9f0a-f6492f83004d", "indicator--e69cc14b-138e-42dd-9044-d8785b618ac7", "indicator--2d212b7e-5478-460d-a7fc-0a646ece03b6", "indicator--5dbc3324-5fe7-440f-89f4-9ac2d1ec7f61", "indicator--ddfcd42f-abb6-4fdf-bf30-3b2317a6f1f5", "indicator--dfc73538-9138-4f53-bf65-4291be2317c4", "indicator--72f1cc79-eaa6-448f-b644-1eb525b3bb9d", "indicator--8ea5b7fb-4332-4be0-8dc6-3a7fc3947204", "indicator--3bb46394-ea2b-4542-a225-4372c41dde46", "indicator--acd3fd8d-0033-4492-b354-a4a5ad190f24", "indicator--f4948169-d64e-45b5-bffd-2b0f525d3a39", "indicator--d0996367-4fb0-42ec-afca-8c6005cbd1ba", "indicator--e55a0823-e471-4765-bdca-bfaadfad8c69", "indicator--97ea3b09-bfb6-40db-9257-2ebe41263d3f", "indicator--dd85e14f-925e-46f2-a662-836d4e30ac85", "indicator--f486b6ef-d4ba-4e93-a3d2-9ce963052628", "indicator--63a8f82d-e867-4d1d-8c86-adf98185f894", "indicator--529005ec-d5d9-4424-9ecd-a93488191ec5", "indicator--0a27e453-5ffd-45cb-bb25-c08566f93e41", "indicator--9b613ed4-b4b2-48e6-a446-aa3cc46404a2", "indicator--755ea6ca-cfd4-4407-86d6-3c54c6e6c2d1", "indicator--62292988-0e5b-4766-a34a-e742be965b68", "indicator--feaa700f-17c0-4e37-91e2-04fe1eed2a1b", "indicator--e86aa672-48d4-4118-b538-92538230e2c2", "indicator--7202b519-a2ab-4b1e-80b7-02df96f5615c", "indicator--227d5e7b-420d-420e-aa95-cd0595962eda", "indicator--01a56516-83c7-4dda-970e-9c60d4388e1c", "indicator--2ad58606-53e8-49a3-bdbf-27d60276759d", "indicator--a4392e8f-ccd2-444b-bce6-4c74ce36045b", "indicator--68dd70e0-7d14-4113-bb01-f7e28c0dc2b7", "indicator--b162e8f3-9d97-4cc6-9076-c2bb79e38257", "indicator--fdff1cc8-2921-4878-ac2f-c126c0d4e19f", "indicator--8d128dd3-a55c-4475-8cb4-703323667d17", "indicator--5a85fa23-8a5e-4011-a6a7-e8469f49f833", "indicator--0a05bdde-9c3a-4c9f-b781-eefe7e5e33f8", "indicator--710dea84-fb6c-4b21-8b61-7037f3425e27", "indicator--a971c147-a6ae-457e-ae5d-7d5c3bbab5ae", "indicator--e970623b-4d13-4248-8d29-aa7d1bfc960d", "indicator--2a3508b7-3f4f-4071-9ab2-a7e397780d60", "relationship--a63f1675-8b4a-42cb-bd42-57aaeab3e994", "relationship--e2cb219f-1072-45f4-952b-e61236df533b", "relationship--b58d858a-4fe0-490f-accf-db0b6554b01d", "indicator--106c5ada-c821-4dd5-b54b-80db6cbe00f8", "indicator--ecfc4157-6cd6-4082-bf8d-87f8491ddfc0", "indicator--20990b35-30da-4bb3-a51f-d059d95644e9", "indicator--f7bdc89d-7cd9-4830-a3ff-4a5450905700", "indicator--676aea94-159c-4cc7-8057-5c406466d4f2", "indicator--410a8cf1-9a90-403f-a035-1017ca534cc5", "indicator--754c17b7-79a1-46d0-b7d3-42e9c344bce9", "indicator--5c6ae8e3-50e3-4af1-ad47-2e182b5db463", "indicator--da91f050-42fc-4877-a096-18aa8a578fb4", "indicator--4e6e2482-60a0-4bca-9019-f7a36144c0a2", "indicator--cbb901e8-50f9-40f5-9e19-7958ea8fc5b6", "indicator--3955f1d8-0d6e-4706-bf3e-70d292e07f06", "indicator--c0bb58f6-6ce6-4cc1-a617-80a7b221810b", "indicator--d20ac705-708d-45a3-a916-3442c2f6e2a4", "indicator--e949b4dd-513c-49e2-8d43-bfb41465f76f", "indicator--0599ae84-e977-4f76-8d73-1558e89222bb", "indicator--7fde424a-0d23-49cb-b708-7a106013878f", "indicator--2ac553d9-361e-4837-9b7f-9016830e7e3b", "indicator--c16fb374-3ef2-4357-8c45-c510bd580c28", "indicator--b9b30fcb-23db-48be-b21e-8e3b687beaa5", "indicator--0444a18f-cc6c-40a7-86a2-93f29598b93e", "indicator--b7cd9d32-6326-405c-bff9-2c61de61bd40", "indicator--06ba4cab-b882-4cf2-9815-f6c641604b6e", "indicator--00416e43-3de9-4d04-95e6-c7f131b40ae5", "indicator--9f03fadc-8fb0-41e9-b335-a9a756c25c11", "indicator--0126bfcc-3842-40fb-9e69-4fed8d9d5149", "indicator--a0274c21-eb3e-485b-8798-de6fdb9e78b2", "indicator--549451f4-47f4-4270-93cf-07541eea1134", "indicator--6824a62c-cf69-495d-bce9-04870c28d775", "indicator--50b2b559-e6c3-4130-a830-26d616664fd7", "indicator--c5fb3233-f676-4eb3-9376-10ba78ba2618", "indicator--6c99b467-37c5-4bfc-9e0f-5ad20510304d", "indicator--0e62d9d1-ba00-427c-8aa8-17ad977d8b88", "indicator--e032d22e-2caf-4b45-8d47-efc8925030f1", "indicator--5fc8acdf-2624-4be4-8e18-8813e5f63478", "indicator--450ce257-a129-41f0-85f5-a8d34c4dce71", "indicator--7e31c398-5bcc-455e-afa2-4771df4e3879", "indicator--0268561b-14d3-4a14-89cd-efaba7c4b22a", "indicator--4d90714d-dc6a-470f-a662-2acd650f9660", "indicator--6318fa1a-2382-4614-a459-b73fc173f31f", "indicator--fcc9cbbc-257b-4760-aa4b-996ae4ae67e5", "indicator--433999fa-266f-495e-905f-4e269b3cf111", "indicator--358509bd-0359-403f-86c5-462378024fa5", "indicator--59b5cdc3-07af-4da5-9603-c385a939570c", "indicator--94e56fd3-c9c3-4bbd-8791-459a43df40aa", "indicator--30d97eef-866d-47a7-909a-2094b767cb2c", "indicator--fe2bc1d6-3918-4c16-b19f-b959126b4db8", "indicator--87256ec1-6bb8-4bfb-ac05-579df70c1a9e", "indicator--d7feeee9-a699-48e3-bd4a-1d256c3744a4", "indicator--4fb8e309-07c8-41c7-82c1-1ac8b1651fe9", "indicator--291924a2-2d7f-4602-867d-20c0f8906e6b", "indicator--4c1cebb1-3060-4987-b685-d0240d4db654", "indicator--01282649-f242-49c2-a624-96b2276b5f72", "indicator--633fb2a6-a4ef-48ae-90f0-74fdfec61786", "indicator--12604eb4-8d73-4b88-adbb-0131f91f3cb2", "indicator--afbd4abf-f84a-408a-82f9-96baacf1c110", "indicator--4d1bbc6b-1c34-4feb-8f2d-e7b435837b8f", "indicator--49d86f68-b9aa-49c3-9517-5865cae3dd46", "indicator--ad6eb1a7-4c58-4f22-b957-ba89d8d77655", "indicator--4cf2be0c-9634-498e-9181-77c4c8050d9f", "relationship--33381919-b5e4-479e-8f87-63ecdd123a58", "relationship--0855b8c2-1c7c-4d0e-aa35-f4d7827867bf", "indicator--354ef7b7-bd39-4eec-9093-3de61854641f", "relationship--e24e1a5d-c7d8-45df-9ae9-3394101ac9c0", "indicator--a489af77-6af5-4510-94a1-5ad3d5f2d0cd", "indicator--0b376275-aa13-4033-b8b5-526e6af5e6b4", "indicator--6cdbbdb8-c66f-4399-9a97-2a913ca20a83", "indicator--687b60d7-cc36-4611-bcab-6adc8c2be9b8", "sighting--38454da4-7917-48d5-9f8b-0e9124ac154e", "sighting--02f809ef-1d34-4ee7-bb60-218fce44c564", "sighting--2aaf5e51-83a9-414d-9afd-0df68d1b8105", "sighting--a5cbb36d-b4a1-435a-8430-aa10b85e5666", "sighting--5676ff9c-282d-474f-8294-37383e134fb4", "sighting--4c9ec65f-2172-4f2a-968e-c7645a1bf1f1", "sighting--d558b97d-41fd-4b5f-9859-34365ecab8d6", "sighting--9f6b1177-79ad-463b-a9ce-e294323306d1", "sighting--21b146a1-a552-402a-8432-cd568e48f841", "sighting--46fe9fff-a441-4472-aeea-22f1e4d5af71", "sighting--1b3decac-5897-4c6b-a722-a129e2883ded", "sighting--c19ae74f-a432-4cbc-b871-732de51d1394", "sighting--e8982c98-01f5-468d-b0ed-092cb62e747f", "sighting--1b303f28-19b1-4cc5-a300-c5843b46ddc6", "sighting--8d71229e-4d67-4071-94d6-66c77403d0da", "sighting--8c837394-f92a-42eb-bd5e-16f27f01c1d2", "sighting--a1dd7ea3-ed75-4c03-9857-37c1909d5176", "sighting--cc4ef223-20b2-447d-88ae-65dd60be5ce8", "sighting--b1f95d9d-b0db-426b-af87-e79f32b5fbdb", "sighting--4bde60fd-fe5b-4288-9c86-4ace2851850e", "sighting--ec9bef37-369c-4d22-af9c-bf26481623ca", "sighting--a3d28511-209d-40ff-8295-b5fc1af08c01", "sighting--cf101711-b026-4ec4-8010-5ad8a544020e", "sighting--a4725186-fac2-4529-af18-aae4bd4fe5a6", "sighting--b00d49ff-5515-4764-b938-9cb80fd087bc", "sighting--f408f769-afc9-46c4-881d-67d8fe94d607", "sighting--0686d61d-cedc-4241-8e97-82bc6b76a977", "sighting--162ab99b-2306-4071-bd8b-ac084f7aca75", "sighting--643bc6e4-5fbf-4806-b21b-6f0017b50806", "sighting--beffbd40-2dbc-4946-9ea9-c1619f1a3be7", "sighting--71505eff-8b2d-4549-b281-05f8dd83f947", "sighting--234a5c16-8308-43ae-bf92-edfbdce702fa", "sighting--defed200-9a78-4816-ab65-173db98041d8", "sighting--d297d671-5c67-440b-a8aa-7a747ac8bbd4", "sighting--c3758464-78d1-4fd7-a426-8ef8921e96c0", "sighting--8ee1d62e-187e-4a0c-ab3b-a14f9e475291", "sighting--3f859d97-5c66-4b65-844f-aab26611ae2f", "sighting--d1c19108-36e9-4985-8744-24d3f4a8df71", "sighting--c225d8fe-5cd9-4cf7-9a73-9eede635ce9d", "sighting--9ad17876-1b76-4588-9c0f-1b2e8649c709", "sighting--9c8d9114-1680-45c4-a157-c3f253ec5a4f", "sighting--2cb30784-35eb-4652-9520-502455c6190e", "sighting--3db4b332-8ac1-4483-be66-07c1d8ab9d72", "sighting--63b400e2-1fbc-4c09-868d-52e5ff5766f8", "sighting--c4a4aae1-e2b2-48f7-a6ec-361511ecf5db", "sighting--897a9763-0a91-4d37-a308-cb2e908ca034", "sighting--4edcf8ca-2f16-485c-a9e3-805d8f329a2e", "sighting--dde50264-d933-41cc-8f0e-10ed7d35bb3f", "sighting--2472b9d6-d097-4038-8b3c-36a26a243069", "sighting--61c2f8dc-1a48-47a6-b6c4-b6df715d090f", "sighting--cacfdfe0-d973-4c63-9613-cfa4020bbafc", "sighting--72aa93ad-8ff4-40ed-8b58-2d4c9a68b5be", "sighting--db0bca4c-48ea-4e41-a5f6-d18a59a65244", "sighting--fa408c5c-ab55-4d86-a2b7-72ea021725c1", "sighting--21e9b056-a5f0-47b9-bb33-ec1586f504f2", "sighting--d15ac219-27fb-46d1-a89e-eae0f97b7aa4", "sighting--8c7647ae-1398-41b4-9f08-68a3dbb40b2e", "sighting--5b9d58b9-3c2e-4810-b64b-3c18fba0c9af", "sighting--f30b16be-0338-4845-ad0e-0787ce660f9c", "sighting--5fde1fd9-ce5f-45cc-848d-58d894ca7caf", "sighting--bbb3c477-aace-4663-b0e0-cd423bdbeabf", "sighting--011e85ea-b5ff-480d-9593-ea6015cdcdf1", "sighting--8882cb22-f8af-4260-83a2-f2998a04c478", "sighting--ad67d1e0-ee19-4689-9dbc-ddb495f9bfb5", "sighting--c4e96ddb-92fe-4701-a1c9-1e71d3d73b5c", "sighting--0b1cac02-e0d6-44e8-b23a-c9570538dcc1", "sighting--74a3898c-e7f0-4b8e-b23d-fbff131516fb", "sighting--28a0d2c9-f805-4f31-b4f6-e3fbde31e0cd", "sighting--343f332a-9597-4eb9-a7bc-23df44dbbbe7", "sighting--6c532e50-68da-4d7b-b128-beb75c77945c", "sighting--0c038e5b-b4dc-405e-a5bf-44ff1875de80", "sighting--a872ff94-f1b5-4c54-9fdb-dcc4ed3f5598", "sighting--c4fdf214-d604-4035-bd1e-536d76b8ddb2", "sighting--4219f5ac-8307-4950-bf94-203ee42b4794", "sighting--82d94828-daad-44de-8aba-0da2c0fa957b", "sighting--06ab8ebc-434a-49db-95c6-f5c57f9c3092", "sighting--2c5e8dca-6738-46a5-8950-740460720391", "sighting--12a22093-dc61-4eb6-bdd1-6a4e0d884054", "sighting--4f268ffc-2070-4ab3-9e58-23cd7202c7af", "sighting--5d29424f-14fc-4437-b147-08ad3adce3b9", "sighting--68bffbc4-e290-40b3-83ff-0500a0f1ce19", "sighting--37ca5b69-e0ab-421c-94ec-a440ecc0297b", "sighting--0efa6860-dd9e-4813-a335-b19c97c6cd08", "sighting--29010f5b-1c15-4f8a-8910-74dc34e5381c", "sighting--ab6aaea5-6749-4ec6-8c0a-00cab1742709", "sighting--c5054bb2-c32c-4b50-b86f-b967b6339bfc", "sighting--5cc9837a-b65c-480a-be73-8997c01273ca", "sighting--54cc046b-3ec2-4b6a-8fa8-b7f97756fd84", "sighting--0a9475b2-2da0-4ae0-9cab-cc3ded47c741", "sighting--6205d2e5-248b-4470-90c1-7a0b33b78e93", "sighting--8d1e4535-a21e-4b65-8dfa-4e1c9e069577", "sighting--4e8fafc2-7e74-4618-8b09-4797b69c32fc", "sighting--2610783b-fd6d-4cbd-8344-11be09251a1c", "sighting--127cd368-cc09-4587-94e4-3e4dc38f241d", "sighting--c2add062-9f1b-4b3d-9c15-6134426d0541", "sighting--21e10032-4bc4-4197-a553-83df7796d716", "sighting--d351036a-d442-4d82-9f9d-26cff2069671", "sighting--90167bd4-49da-4a97-a6a7-658bdeedaf83", "sighting--d29ccdb8-6530-48bc-b956-47be617e180f", "sighting--08fceb1e-7a7d-4675-bebf-feccfbbc93d8", "sighting--0b978ac1-140a-493b-b5b2-9972578609b4", "sighting--61f8f3b3-d2f4-45e1-b85d-010bdc80e528", "sighting--4fc8ee41-3319-413e-b014-3a5deb5383a0", "sighting--7bdac1d3-686d-4ae4-a9c5-c932ed5af92d", "sighting--bc6d50d8-10e6-44e3-952c-daa3b13089cb", "sighting--cc43a291-0719-494a-80d0-480fd1ffb2f6", "sighting--60da387d-56c0-42ef-84e2-d96c0ef33ab3", "sighting--31c4f80a-eb18-4835-873b-148f024261a5", "sighting--fc52029a-1a93-4352-b79f-f048ef20e6e9", "sighting--67f8b806-eac0-42d7-8d37-8bf905fdfd6c", "sighting--f58cf2b9-75f2-4edc-a003-6e530621aeb8", "sighting--ad3382f2-ef3e-4e3a-a451-e9324adcfb86", "sighting--8257d23f-688e-43c7-a6aa-320e558763c6", "sighting--428bacf7-9c43-4fc3-86bb-cbd9b6a149b2", "sighting--dd00ad41-53f4-4cfe-991c-6872afb1a2f2", "sighting--8240060c-0c2f-4c99-8705-88a21b34b846", "sighting--b67c0b2c-bb04-4e66-8540-19c2e11f6bf5", "sighting--c1e218d4-85f9-44c2-a4d8-999af5639b28", "sighting--c0bcf17e-f971-42a6-ad04-fed892be9c9b", "sighting--0baa2847-0294-4e82-bdb0-471e7caecfd1", "sighting--6f8658a5-216e-47be-bb8c-f27a0b0bd06a", "sighting--dc5bf972-ee18-4001-b9d3-c7784fc3f5df", "sighting--6284f33d-2eb3-4eb7-8b50-6352670175da", "sighting--553a0552-378d-4a08-a2f7-207eaa12ee63", "sighting--bb59c154-a5de-4592-9cbf-af59c09c3d36", "sighting--ce4f59c2-8f30-422f-8db7-78ec825f8244", "sighting--054a5bbd-b8a4-46c2-9974-54421a9fac17", "sighting--ed3dc35b-6bf1-4cfc-a184-f2cc93745768", "sighting--179887f2-c4fe-4d7e-a2b5-240944372f95", "sighting--2cb0599a-2eff-48d9-ba0b-f7a9cf48c3bb", "sighting--6e5edcef-12b2-4a45-963b-6aa0fa931876", "sighting--aadf5cd3-b165-4c9b-bf57-22ea89c12a42", "sighting--938250ea-bf2d-4395-a523-905b60ecde33", "sighting--77f8df10-5b22-4e43-be85-da677b48508d", "sighting--3b4ecbc2-7b5a-4e42-883b-49134e86849e", "sighting--123276fd-d700-4376-9d2c-7e6fd430b69b", "sighting--13b890fe-7e73-4900-8f92-42b95a08959c", "sighting--9c55b4e3-4160-454c-b993-5e2b819a7d44", "sighting--262f4b68-b02e-4961-acd6-355471f620eb", "sighting--1a3547a0-437c-4d34-95b6-358a6f19d746", "sighting--35e49c69-8b7e-4600-a9c0-d83a8799546d", "sighting--fd981c8f-2091-42c6-b0ce-06b5a95e8657", "sighting--7eb48763-c3e6-40bf-b41c-43166336e3d4", "sighting--fb7d5595-5638-42c3-b17a-0bffc7661e02", "sighting--9b7a44ba-f102-40a6-b468-190a57dda0a7", "sighting--f68b4f76-9628-40e0-83e8-1ec7051cf50b", "sighting--10f60ec1-cfa4-4a7a-911f-9b5367739451", "sighting--03eeef7e-fe2c-4fbb-831b-46ee7758d957", "sighting--0f23c7f9-8bd4-4ba0-b4b6-ccebf738a0c3", "sighting--e60d6ecd-53a3-4839-906c-02da741e7082", "sighting--8969511e-ce3d-4896-a505-84c603f1319b", "sighting--918c1088-68fe-493f-bddc-d0520eedd7fd", "sighting--2a852dd2-a7d2-40ec-80f0-1213849115a6", "sighting--10b56fb8-b65d-4822-aacf-6b42c39228a1", "sighting--56a573c1-c489-416e-b8a8-143be93e373d", "sighting--5ede20df-968c-4432-8149-5ba51008ec21", "sighting--1833b8eb-6460-4e13-a8fd-0ee2f1d87ade", "sighting--52cc64db-b79c-4c8d-81d0-acbd2a636d18", "sighting--3d560cbf-925d-468d-9612-de067ce1522e", "sighting--a1713dd1-6756-45df-8c23-f18c29811a8d", "sighting--053c6929-b0d3-4db5-bec3-8ff01bc6ba7d", "sighting--11386e5e-fb8a-4a48-9f39-7b93337b07fe", "sighting--1a57ee27-b26b-4002-8465-2e10e94c7142", "sighting--971b9a0c-1138-4b62-9126-64d6cce4a280", "sighting--bf24dbe6-80f3-4970-a2be-727534557f90", "sighting--3e3387d0-f185-4e3e-93c4-c2239833f3a2", "sighting--1d57793c-708f-42dd-84a1-62dab6260ddb", "sighting--efaefbee-9a5e-4968-a9b5-4c607a022cad", "sighting--c23949a0-bf10-47b0-a3f5-e01cde5a8c61", "sighting--2b5ca0c7-91e6-4798-a788-5b3274ff1dfd", "sighting--dbf14ff7-fe34-4925-bb9c-96f77fc4c7f9", "sighting--aa2ed51e-384f-4503-a90c-e6f67814548b", "sighting--f9c90e69-3bec-4ece-b6b7-222dfc64967a", "sighting--d7694b40-c9f8-44d4-9b80-ac4721804908", "sighting--25f03410-3c95-43cd-8ad3-751864e5d009", "sighting--0aa8952a-6d6c-42cd-b3c6-33cf62c8e7d3", "sighting--7547c09b-7742-4d9b-b99c-e5a15a27393d", "sighting--624f3d06-3ceb-404d-84e1-f9ea3300c641", "sighting--0eaccf64-0d0a-4b12-9b1a-29cd66b080a8", "sighting--a1f3aaf3-d5b6-445c-a8de-0861ab63c0f5", "sighting--ad32ada5-07bb-48e8-a6c1-516a348a4a5d", "sighting--0e94a1b8-0575-4d84-9dc8-d356c60f47ca", "sighting--708f3b4d-ebfc-49f8-87c9-beaac16ee8b3", "sighting--2749ebac-78a1-4c05-ba24-6c11f32a320e", "sighting--87b7542e-d515-47ad-821d-9a9f377f7605", "sighting--9419bc60-5612-46d1-a8e5-53299599f2b0", "sighting--f8809f34-0480-4b34-bb90-76eafe38d373", "sighting--da2ed750-4525-4649-97b9-919d236e4b48", "sighting--fee6c280-be78-40e9-aad8-708ed7b5b3af", "sighting--65d76e00-2c9b-4423-9d1f-6bc0e2cf6efa", "sighting--f8e037c5-9150-4931-a608-22b6a6e524f0", "sighting--79438da2-2da2-431d-a97d-1f99fa78ee96", "sighting--17db9dea-f82d-4b13-a15c-bcad61e12d19", "sighting--5b110ba4-471d-480e-90a9-e8de07a7f67e", "sighting--69c8b507-754e-47bc-a6ea-3c5f9faff226", "sighting--4fa38f19-e900-4906-a913-1c5628eca57d", "sighting--8ba05731-196c-456a-9d83-fc506e8259cc", "sighting--3a3e8b1a-4ec2-4f3b-aa81-817955c38eae", "sighting--95717509-b261-4607-8895-2aa129b11609", "sighting--c34a282a-578c-49d2-b344-800eca3635ac", "sighting--651cf9ef-1850-4feb-bf3e-960420902688", "sighting--a307bb3b-9537-486a-ad4d-6067b42850c7", "sighting--e3dbe358-dec4-4669-9e65-8f09b7496ebd", "sighting--62bc169d-c8e4-4ad7-9dfb-4cf30c42e076", "sighting--e9d3ab2a-a075-40b0-a388-9225196485cc", "sighting--0a325ceb-4cde-4a82-8d68-c4454e221ec8", "sighting--92267014-6da8-4410-97d5-2f40b1160d43", "sighting--50a48829-2421-4032-9ab4-6711372c517f", "sighting--e82d61f0-bc6a-45ee-b859-9798bbbd1fd5", "sighting--3f1ca203-f473-4814-86f3-79041026a8b7", "sighting--0cd8e5a1-591d-43b2-9439-5f874b48ea73", "sighting--ee8a8a65-0088-41a3-b162-d2f89db63d33", "sighting--d02bc99d-8c2b-4722-b37e-cb90db076fc3", "sighting--d2172b69-a45a-4c9e-873f-c31364273533", "sighting--d8057072-4b60-4b63-a56a-534e8010a6cb", "sighting--ddef034e-eeac-4b23-a997-a95a81ea1bee", "sighting--aff24fd5-b023-49b3-bc51-202de7c7d982", "sighting--2d341138-7c16-4eca-a4dc-e91ea307c432", "sighting--4b17d028-ddcc-4ad8-9ff4-6ee95878ac69", "sighting--248c2d1b-95d8-4093-8189-e7ff74d86593", "sighting--8acc8891-da95-416e-a055-05ec3461dd16", "sighting--910499d0-88be-434c-bc7d-ca182bfe9c3c", "sighting--d0f4caa7-fb73-4d3b-8ec8-87ae679624cd", "sighting--9a22bd5b-633d-4e95-bb9b-e369414fa9bb", "sighting--d873b88e-3b9b-469a-8bc9-612afc82a655", "sighting--95c0d5d5-e5d0-4af6-b3c4-25e64fa72d18", "sighting--c767ac00-fed7-4d8e-8983-2208f8619b66", "sighting--6eddeff6-3d4d-47b3-9a34-c4f95c517158", "sighting--612275fd-3b00-466f-9196-29fdc2941060", "sighting--9b16d580-e6c4-4366-adcb-a62319976dbc", "sighting--6382479b-fc4c-4ca3-90b9-f87706c0c242", "sighting--4266af9a-fd69-4aae-a5ac-9c4d2cd5c84f", "sighting--aec2bb63-68c1-4f2a-92fe-2c7e506d1353", "sighting--9a6124d8-982a-4ee1-9846-381f827b5857", "sighting--f8956019-db41-4a92-9008-0d2e590edd04", "sighting--32ebce8b-2a51-4dac-9be8-73300f184467", "sighting--96b2d042-600c-47b7-8b4d-30a67393d130", "sighting--ffc24263-0e34-4ee4-a0f3-2c767a862387", "sighting--7bf7bcc2-a3a8-4626-89cf-361330b4ac19", "sighting--7bd7a4dd-0510-4f91-8282-223186794ef8", "sighting--c7603cd9-4aa6-48c2-a771-3d84c847a43c", "sighting--8bc3827a-a92a-449a-8673-2e7fe810e086", "sighting--1ea22f23-6df7-404a-83e4-59bf8d912f27", "sighting--eeea0ffd-d774-480b-9c11-c7c08371c34a", "sighting--48e6a307-fb84-432a-8a2f-f7d7c31b1fc8", "sighting--f6373166-6ede-4805-a769-2bf9be11ca91", "sighting--83ee7b9a-cc0a-4420-9219-9df29ea4b278", "sighting--189a0415-9f5e-46a3-a676-33ef3fe2a6ae", "sighting--ea4b0fcd-788e-4316-a747-1ede9b7ee80c", "sighting--bc8bbccd-5633-4771-a76a-af3d0ee3c493", "sighting--bc78ad67-06b8-48c1-af23-e37c27b6a7e9", "sighting--b625cda6-591e-4089-821c-455343b42dab", "sighting--e149453e-6c98-46a5-b974-e4807627f4ba", "sighting--8b201dde-cb06-423f-ae7e-9bc85d42ca4d", "sighting--c6e3329a-27f2-4274-b482-5edfe64fee23", "sighting--3e7266d4-a280-41d7-8377-7ffbc296b35c", "sighting--b20af8f0-bce5-498a-b6c7-80ddce12150c", "sighting--f02cde8d-5dd2-47eb-a8ba-b4a4ae90bd31", "sighting--fd201acc-d80d-467b-8782-ed2f689ef0c8", "sighting--2fdf3e87-f792-45fc-8027-2fa96f7a49b1", "sighting--9b59a8b9-eef9-44f4-b4f8-2cacc908aa87", "sighting--50c4e9e7-d24d-4c45-bb4b-1897bdfd95c1", "sighting--599b905e-d1b9-4eac-9c4b-184314b812d5", "sighting--1a000576-90be-41a1-b63b-ffcb31cef2e0", "sighting--cb0d6b6f-c9ef-48ef-9b3c-4095c043e190", "sighting--0ebf1a8d-395b-41ff-b783-f4173e1e7c16", "sighting--bb293e2a-a903-405c-9ffc-dba2464b1f57", "sighting--bc213375-ebed-4bb2-b317-d5dba42a3201", "sighting--3588ae82-4e1a-47b0-a7e4-4edc8f9a3075", "sighting--1922294f-c672-4dcd-a796-41c40b9d4162", "sighting--cf41bf4c-04ec-4bce-bc26-9b7f5cb3d232", "sighting--091c327a-bc1c-4021-86aa-b2e54665b150", "sighting--0eda476d-9c5e-4667-beb1-f4779d104c6c", "sighting--5dfb7cb8-7e29-43bb-bf46-988a3b304d82", "sighting--62c0d150-82c8-4f16-ad07-a72860330ed8", "sighting--a8b61a5a-97c6-4dae-87c1-6e35abaec861", "sighting--f8303da8-a4e3-4095-a31a-9a6dbbc60424", "sighting--591e655e-a525-4785-8474-db375b27e8fa", "sighting--ee388a2d-8713-4b5c-aedd-5cc0222c1b5b", "sighting--b54a743d-5d3c-4be7-b052-11411650c489", "sighting--55a1430f-f81c-4250-9ae0-ac98f8868110", "sighting--5fae3e4f-e385-48a2-9b27-a4f863ea653d", "sighting--beae94ff-6bc7-4107-a1ed-cc904a722312", "sighting--4eb04cd7-610e-4756-a6a8-ece9c68e61e4", "sighting--14242cf5-e168-4685-b6e3-d130fba8e950", "sighting--0e3db41e-4b87-493f-86ab-82913f1f7b39", "sighting--b3e7b59c-cd7a-4980-93ae-25e102759a57", "sighting--664be7a3-f214-43a0-a3e2-84aa195838a5", "sighting--1e185190-6192-437a-b9f3-84cb31ff1af7", "sighting--131a71ef-2443-431b-bc50-28894c3cba37", "sighting--822f1645-7908-4c8b-9f16-9b9c5c077071", "sighting--c3b2ea31-1d4c-4014-a493-b89adba1cb95", "sighting--cb9c438a-3d01-4c0d-821c-eb3e25cd8b37", "sighting--ecc6844c-c1bd-496b-9f20-97715bad263e", "sighting--b8d1c859-1714-48f0-aac6-7476e9ceb932", "sighting--d25dd302-85c0-4920-afc7-9de81e29e6aa", "sighting--e66e0c25-e138-4eb1-a272-0f5ae7739f6b", "sighting--c86e114c-0f51-447a-a117-04f0d0b8b552", "sighting--444d719d-3446-4556-a910-a667b8820e99", "sighting--57ba43ac-b5f8-4330-8e3e-0b1788c3c473", "sighting--0ac93ab4-ff3f-4f34-a546-f69e40712c32", "sighting--39c823a5-6824-4d7f-bb2d-c40571bb5ef1", "sighting--671b4657-9727-402f-b77a-c37b8b8883bf", "sighting--696ce4da-ffbd-4d17-824d-651358ff93cf", "sighting--631adbb1-ebea-418b-b8d1-f1bfad7cc02b", "sighting--1ff2bc0a-a533-4c28-be2a-7dc827b86dd6", "sighting--d9119f72-dfe1-4caa-8ae4-a48548980f5b", "sighting--736f4827-cf31-4766-a49c-fbe7a5daef6d", "sighting--f7a06883-9d54-424e-8d0a-8f55ef83f439", "sighting--17682a1e-b3e9-4c35-badd-260b6f3ac388", "sighting--e06909dc-4f27-4987-8464-808c5ee3c6c8", "sighting--903a82ef-f15c-404e-a824-6d56557046b4", "sighting--f4a32a5e-dcd3-46f7-b5c4-388caab6694c", "sighting--9da5d14b-5f9e-4817-b4a3-e375cdddcda3", "sighting--b994d0b7-05e6-471c-9c42-18dec400aec8", "sighting--2063e8c2-e32b-4a81-955f-e5565df3e627", "sighting--0453a510-7450-46ff-b96b-e07e3621adea", "sighting--07b9d944-d3c0-483f-bcc6-7f504e74320d", "sighting--00e65bab-8884-48f8-9b36-bd8494382a57", "sighting--e8b796fd-1e85-4f63-a61f-bdaf7d25072f", "sighting--739390c6-2af4-4885-a4ae-5af545960280", "sighting--b9778110-3be5-4791-a5a0-e792557e455a", "sighting--79e7d07f-af53-411a-ba7d-c3e8329892c9", "sighting--b0be225e-bd1e-4d99-a416-c2d7477a90ed", "sighting--203de085-6397-4708-8333-0fd5736664fa", "sighting--7e5f66c5-0e76-491b-9021-acf665f71dbc", "sighting--2f95df94-ad77-4d0f-a9a0-e3f82ee04206", "sighting--c8ef002d-3e70-4a09-8f08-69d4c89dac37", "sighting--089d111a-9b5d-4b5e-a91c-4580c1a32c17", "sighting--19c34ce8-6fd3-4148-8776-bb0e9b87821a", "sighting--172eb69c-4edf-4a9f-a183-933e537456ce", "sighting--311d29c7-614b-48e8-8c2c-eda3f09ed3a5", "sighting--d929fb0d-6144-4be9-ac88-6fb925b2526c", "sighting--13cc926f-f972-4d32-aa50-42b2d1e1f19d", "sighting--f476ab63-349b-4b7c-811a-02f915897148", "sighting--b2a8bc5e-6cf9-4fdb-95af-74fbde60638a", "sighting--24fbcc6d-8bb5-4039-971d-a6281c967c56", "sighting--07d4f1f7-361d-44ff-b7c6-ec606b78c227", "sighting--6bc9fa32-fc27-42ff-884b-065aab01bf4a", "sighting--df70721e-632d-4a88-b71e-1379d915a2ab", "sighting--e1c804fd-38e1-483c-9065-84198df4bdd7", "sighting--060f315f-77c0-4fb7-8018-82912bcfce31", "sighting--9f762256-a61a-41b6-acca-b98bdbc104f8", "sighting--c1a7c4f6-c6bf-402f-9db3-4850fb46a894", "sighting--144ea21f-c1c6-4944-91f7-97d174e44022", "sighting--e1eee1e5-2bed-492d-9254-44cc525a4271", "sighting--e4605620-7f5a-4979-b71f-58fc95b46795", "sighting--99318457-cdb3-46b5-9747-4c26c49804ab", "sighting--9d92405c-f2b5-4b88-93e2-d2b4a4ec21f1", "sighting--4c70f891-571f-4cd3-986a-d232738de919", "sighting--dcf5bb89-7342-4f33-8f40-de269a7c673d", "sighting--e3095169-f7a7-45e2-b964-56e848b23a7a", "sighting--e8a810d8-6d37-47e1-8e34-498a33dbfac9", "sighting--c48df8df-492f-4be2-afb1-78638ca8eeb7", "sighting--c71f4bac-b645-4b07-9d6f-76f6c125b491", "sighting--8c149efd-9d9d-4ca0-9092-076e64ba57d7", "sighting--f911e57f-96df-478b-b2d1-e0de450dfe20", "sighting--add7098d-1d1d-464a-a958-4e061b6ca885", "sighting--e9b36359-a467-4f00-9daf-4e0345fe0492", "sighting--dee87529-0ccd-4639-9b27-a801d35826a0", "sighting--578393eb-3dfe-4c71-a824-ea9d622da451", "sighting--d6b1352d-6827-440c-bbde-1008d87bc73a", "sighting--60b1bff5-e5ea-4cb1-b09f-24e0438edb2d", "sighting--5398998d-2d5e-44ad-8cb5-aa47f17a051c", "sighting--0f80797d-3c26-4a96-b1d2-cebcaca3b978", "sighting--303dbcbc-bb9b-4128-9cf3-dc7429a9043e", "sighting--d49cb0bf-a45e-42ce-a1bb-c2deca72116f", "sighting--622ecbe8-8bc4-4160-8d18-88aa8b3fdb7e", "sighting--4b99f306-7b02-4f70-868a-408ac0078444", "sighting--363d84e7-c35e-452c-907b-4584f03dead7", "sighting--2bc88f00-a052-4735-8603-f43590d53f5e", "sighting--1e859b39-1604-4e33-b529-a13f4d927047", "sighting--eb902ade-c417-425e-b0d7-11f55bd05262", "sighting--d379db3f-ee3a-4c3d-ae16-60ed8534bcf4", "sighting--e74ff098-6d85-4c59-a739-631087281f24", "sighting--f3e616dd-eaaa-4c6c-92c9-705fc546230c", "sighting--ff8b761e-b7c2-482b-b433-651c5d790558", "sighting--9d260568-1084-4cb2-b49e-8ccaf6acf532", "sighting--31e13d39-d5fa-4558-9e8d-0f1627880bf6", "sighting--7739a17c-1fb6-4356-9122-90009c8682d7", "sighting--11df9a2c-856b-4325-a284-0d5f0c3e5e0b", "sighting--ebc7479e-bd1a-428e-b71b-6a8fd34a2b27", "sighting--dbb79e0f-f143-4fed-8838-8f3f94122249", "sighting--655e2c93-fc16-4615-bddb-502439787867", "sighting--7ea3580f-042e-436f-90a8-68c8886d5b84", "sighting--1430f566-29ea-42f2-b0b1-6058c1b094b5", "sighting--f4629d8d-8c25-44b9-850f-66e7b347e23e", "sighting--80930433-c55d-4d18-a07a-7b47c7bcf73e", "sighting--2929b544-7c67-4fba-99ae-86af9573b7b0", "sighting--05386864-d037-422f-b9df-2fb9f33a4abe", "sighting--01d3f6d2-7e24-4f69-9175-9d9c18c41ecc", "sighting--0538f467-3705-4b09-b344-4a6feb2ba627", "sighting--c518491c-d6ed-42be-972d-b97a2f523df1", "sighting--3612ef15-0244-4b06-98f9-e0379c6eca9f", "sighting--a151e653-c45c-41c8-80ad-ff6db9a8883b", "sighting--3ad1b960-e034-41db-a3c0-31ea5ccc403a", "sighting--ee9c7a28-1057-49a3-9e56-8e404bd3bc24", "sighting--8c8eb13c-47f3-4202-8cb7-c3c0f1734ad7", "sighting--b33bf98e-5956-4a4e-a760-a30514b2c0cf", "sighting--c7a99627-de43-40ef-be43-0380f30b330f", "sighting--0e7d051c-6404-4e95-aec9-928e403c7cde", "sighting--d04a2766-7ffa-43b4-95cd-3008d348ee3a", "sighting--f0acc709-c29d-4c49-b04d-bd0cf8909cf4", "sighting--bce74d49-5cce-4a54-9a6a-f66c7f8ead93", "sighting--f88fe85b-33cf-4f7f-b260-06e9012a6f02", "sighting--d4cccf26-73dd-483b-a96d-5aded201232b", "sighting--1c8fca12-2403-43e5-b99f-ad4611d9ded7", "sighting--5ec20747-ee78-446f-a55d-f51822c1049c", "sighting--83e9d7ad-7514-4026-826b-ca544553b1e4", "sighting--c77dac45-c9ef-47ae-8d37-dbbd8733eb5d", "sighting--981fbbd0-8f25-43fa-90a2-5910cccce7e0", "sighting--c8ce509f-529d-44f2-ae9f-03ff4929a67f", "sighting--53148596-c902-4cb9-9af5-d3952d190290", "sighting--f5eb562c-eb2a-44d7-8cd7-33bff650cca0", "sighting--35ed57fb-32e3-413f-ac30-443594e656fa", "sighting--cb8313e4-c731-42b8-8c3b-68660907dfbe", "sighting--e5fb3663-c8c9-4ba6-9880-5d1846647ac7", "sighting--999d0255-09d9-4d79-8e22-c901b229a2cc", "sighting--bae9357b-4e8b-4a0f-b90b-e83ff9037e43", "sighting--89b4483f-e26e-4865-9b8e-525d0be4726f", "sighting--229feacd-5cc3-499a-a425-12194a1f1cf8", "sighting--3a5133b0-9f7c-46cc-b705-bc407e5d02fd", "sighting--c003a7eb-fcd3-4429-a39e-25214d0b49aa", "sighting--d2f7fe20-2d33-4dfe-b5af-b57819cec247", "sighting--4589e472-0c8b-469c-9d2c-362e0b0aec4b", "sighting--b01cd973-bd68-47e4-96ea-3b693f3c787f", "sighting--286c30fb-6d83-4aa3-a527-f0123214bb79", "sighting--16ba2247-2f53-4d2c-a0f1-7462270c878f", "sighting--5e3b0f8d-99c2-46a8-95c1-b283b883e0a3", "sighting--2e8e2083-e516-4ff4-95fa-c96339c1565f", "sighting--bb1b7f82-d7c0-4d49-b323-6ba28b14b738", "sighting--3c76b41f-199b-43e2-bfa8-3a840201da26", "sighting--aa8d6bde-abdd-40aa-87e2-b5ec190dcbc1", "sighting--1f545cd0-83ae-49e8-8817-60464459c151", "sighting--614eec95-169b-4cff-9d9a-c2ce1a4a4365", "sighting--ead06f68-5a14-4b1f-b000-7c64956ee08a", "sighting--3779840b-53e6-4d5d-a5f9-27df59538a7c", "sighting--e4f80667-c6e0-46a0-a90f-f54e7fd0c067", "sighting--e76798f0-10b4-4fc8-92c1-bf5a2fda45d7", "sighting--68ead2e2-8a35-42fb-9907-9612aa8e1f5e", "sighting--0a0e3fa6-a1bf-42f6-ac1e-1bd9990499cd", "sighting--a48886b5-2d51-4c9c-9367-6463321818aa", "sighting--13650c22-0192-4321-b65e-31decde45d4d", "sighting--a76816c3-5a6d-4ad2-94b4-30a860f5291b", "sighting--d64decb1-b01b-4ae7-94ea-47c5809ea7e5", "sighting--9f36ee85-6e31-444f-beec-803fa5a3fbf1", "sighting--d37f8394-e855-4746-b81a-830f6068d925", "sighting--67338586-63b8-4a1d-b91d-6a5dda05e9b2", "sighting--43454461-15e1-470d-a4bb-11de6b96adae", "sighting--4c931d38-cc2d-4ab3-a7f8-a232c2fe9cbb", "sighting--458211f1-ed9a-4f5a-9e1d-2a009e7c738b", "sighting--a4e5b728-0d7b-42f9-8cef-f41c48b4c26e", "sighting--a89ebe3a-d284-4e60-8d2e-454516b98cb3", "sighting--057e8c69-0e45-4959-9b51-ed73259376f8", "sighting--1ed83eff-0cc9-48e3-b926-6d4a7454ac7b", "sighting--10229755-5ced-4aa3-a49e-01db52815e11", "sighting--475878c0-c278-4d33-a43c-a897db94e4ab", "sighting--2130b293-ed75-4923-af6f-275115251ff2", "sighting--ce8f2a59-e612-4948-aa2d-522d03ad2de5", "sighting--f53ce924-e92a-42e4-942f-06b44b5f4312", "sighting--0627cb7e-d503-47d6-a043-08324bbd0be4", "sighting--87d3a2bc-0f12-4b46-8618-73a0f1d14607", "sighting--df88b868-2167-4181-bec4-b2a878844b78", "sighting--55bb59ab-b513-4326-8157-7bf4d88916af", "sighting--e78606ca-5a17-4393-95ad-c4d90cab34d8", "sighting--efde52b4-f33f-491f-b0cc-e19690e61df8", "sighting--58c1f6f4-ff37-46ea-9474-8ecf7f32bab5", "sighting--13769cc1-1afb-4e68-9df1-9032d176be81", "sighting--9188ee44-0c50-4c9c-b22a-f17818577bf6", "sighting--53e3f9b0-3f80-4c7c-aa23-b324aafe261a", "sighting--5b81edf7-45bd-4036-bda4-bc4305385cd7", "sighting--3ab161cb-bfdd-4952-a822-3705253afaf6", "sighting--5d0ac847-b571-4313-be4f-095ee30fe5dd", "sighting--b189deb8-0f9d-42f1-8eba-b1041a44a46b", "sighting--d4f45b4a-f45d-4f97-b8fd-ff7e895093be", "sighting--0bc5ef82-8496-4458-8a27-9b28f13771a9", "sighting--7927eafb-4ec1-406a-8f67-83b10155ddfc", "sighting--d2d81391-3a29-47f3-9c21-d6c14cd33c90", "sighting--adc7a5e2-a33c-4893-8176-f38aa8ea70ef", "sighting--34270e9b-7abc-4a40-b1cd-b1e154feed80", "sighting--fba68ab9-b9f7-4bc0-bc15-af514b64ebf5", "sighting--918cd211-e352-4dae-badd-456f99ba62ea", "sighting--ee944bad-1a43-44cb-a26c-77c15dea6e03", "sighting--8f7894ab-70af-4e3f-895a-486c3b7bdf33", "sighting--77078dbc-4f65-4059-8f91-473b340242f4", "sighting--8a32d7aa-c16c-4391-9a23-3d0864b19b07", "sighting--058ecce4-0350-41f3-be70-c6e8a8bddbeb", "sighting--e6069002-dfdb-4400-945d-df1ff257fc10", "sighting--3bbdd981-8496-4a17-9582-4c11ed74d5d0", "sighting--4a56dd7c-d190-476c-bacc-3c4196744f82", "sighting--a7fd153c-4ff5-456e-98ab-371a824581ec", "sighting--baee9a00-4bb1-47af-baeb-be5a9b6b78e5", "sighting--d4748387-48ab-4345-ac13-10138c46ae8d", "sighting--35e6d550-a079-4e93-9305-a464ebc31807", "sighting--e768fcb0-9f9d-43b1-bd2e-cda6886666cb", "sighting--c1c46261-be7d-4198-bdea-ee492d583db6", "sighting--ab2408ec-1153-4eb5-8579-7621aeab9af1", "sighting--69ee4e64-b8d7-40c0-b8f8-ee4e15de2160", "sighting--f0adf4ea-bf25-4cba-b6a5-e410b3275e5d", "sighting--23c19e6c-50f5-47ba-80fc-5587a408f643", "sighting--bf850d58-aeb3-4735-a54c-0eabf62abb66", "sighting--d923da9e-793e-4537-a057-7faf4810815b", "sighting--561bcde7-36f8-4a24-a444-e28e00e7d459", "sighting--48dbdf21-00cc-456d-a2e6-451384d8fde6", "sighting--073c454e-873f-495b-b81b-57df653068d7", "sighting--75240cc8-a61a-403b-af94-b74b5eb5fcb7", "sighting--bd712f93-8642-4663-94de-f29a84c09882", "sighting--320b6afe-c1d5-4362-b280-1af69a38daef", "sighting--0babe5cb-1f57-45a3-9df5-d0dca09b3ce7", "sighting--b82846e3-37ca-4bac-8b62-b4e723baad3a", "sighting--b57f1e4e-4402-405c-ba32-adeda36d5d7e", "sighting--2485ad32-53c0-438e-93d0-4631c552de8f", "sighting--ff43f051-d5db-4ca0-974a-d51e3602bbf8", "sighting--b3cbb07d-7816-4694-8618-a9886f2e79ff", "sighting--6cbdaed3-ee19-46de-9ef8-f40a6772f3d5", "sighting--9634b8e2-bc60-4b4a-8c8a-24fb99a45ea2", "sighting--83a03685-06ac-43b0-8d39-cb538c922f27", "sighting--2957bb1d-a7b4-416d-a2dd-0a19592dd0e8", "sighting--db2d52dd-e334-4d95-a212-e13b67e6bd23", "sighting--5d442ec9-634e-40d7-905b-8dcdfd7173a4", "sighting--2be90bbf-c88e-4482-b287-11a30d2922b6", "sighting--799e354d-f891-415f-a66a-1bb0b197ef96", "sighting--5a85811d-f858-41dd-8fb5-12ab75d8509a", "sighting--8f95bcf8-90be-4161-8727-20adb5914675", "sighting--ae7add02-77f9-4cf3-8692-736142f35763", "sighting--2265f280-3258-4e6c-8519-5fbeb9f941ee", "sighting--400c34f1-7bc8-4199-a352-bceca5a67755", "sighting--c13aa699-7326-479f-9241-a7bc9535521e", "sighting--a1459094-e94d-4566-bc10-02f79d766a73", "sighting--92bd43b8-ad94-4b19-90f2-be2dfbb43961", "sighting--7876336d-b10b-4bb3-9e67-184b5e39498b", "sighting--e4305cc9-68f6-4be0-bbf0-6867ec8ec232", "sighting--746b342e-d597-4572-bd06-c374632e70a7", "sighting--1c7b0025-0f6c-4ca5-baba-34bb9fa4b400", "sighting--6a24def2-f2aa-4c13-8a8d-34b5529fa6a3", "sighting--b033f32a-d2a2-48b7-8ba0-cf9682e77100", "sighting--c225a722-12f9-4667-bbad-d7ec02d0583b", "sighting--11fd12df-4deb-407b-ae20-669d4a073b38", "sighting--5975a672-6ee0-485a-aa7a-2c7d6e92533c", "sighting--8bef89b3-6289-4a62-beff-cfc87289b651", "sighting--ca0cc2be-967a-4e2a-badf-2c94fa3048f7", "sighting--91650ffe-8701-4dfb-bba9-3374077d568e", "sighting--cf00ece8-dc0c-44f8-9124-9ee007613f08", "sighting--b57e52e9-63a3-4094-b8fd-ad594555a27f", "sighting--f5a1d385-f552-4ba5-9e23-2fdce0fc0e1e", "sighting--079fa698-0d96-4750-b5cf-1b2f1b1f147b", "sighting--1b4bf979-fbd1-4137-bd4d-ea6bd5d3a64a", "sighting--f3297c9e-504a-4969-86aa-8d1510bfd6bb", "sighting--c3335401-1949-49ce-96ef-7969e10b94c5", "sighting--7a3a0e26-bfbe-419c-bb0b-4103908e31ce", "sighting--b402e881-daf5-466f-97ff-703e0e6a8146", "sighting--6d5aa0dc-3c23-4ff8-8829-686eaa604ebe", "sighting--1d55c1b0-88fe-404f-8ff1-fea99a934c26", "sighting--0a420627-759e-49ae-bdb8-b9a9eb782893", "sighting--75b8d072-458e-4680-86cf-08cd69f1c05d", "sighting--1fedcd4a-a249-4692-8cfd-d6d85af94bf6", "sighting--0a355ce4-1347-4de1-aac9-64faf3efbc74", "sighting--64585cb6-cd79-4dae-81c4-7ce6d3f3a91a", "sighting--8a65ea12-e31f-459b-addb-122907afb85d", "sighting--b58b7594-37c8-4650-814b-5587d579bd17", "sighting--cc4dc4be-8003-4398-b696-0c232533aea4", "sighting--0ee2edc7-d81c-4bd2-80c1-1657fa2f591a", "sighting--ddb64540-590b-4410-b56c-305c2cb31576", "sighting--dfae7b77-524a-4d27-a034-cfef14811d3d", "sighting--d28356d3-5fea-457a-86c2-134fc01118a3", "sighting--3ba59e90-959e-4a80-b48b-5090c14bc824", "sighting--320453e6-8628-4cd5-890c-5611e5acbdff", "sighting--acdd6e81-3a58-4021-910d-d986adc52c1b", "sighting--5dbbabf6-276d-43ab-99b4-99d913126bd1", "sighting--0faec4c9-d32c-43f5-ba0b-839373d4cbc9", "sighting--d8e4f8dc-cc82-4c20-8cd2-c396a6b65420", "sighting--a099511c-3936-4cb4-837e-66173845fd2b", "sighting--b291d5d9-87d7-4e6c-a257-feecb6fabce1", "sighting--f94fa586-2281-43eb-bbb4-5d451adad580", "sighting--331ced64-1fc2-469f-a074-b31917f2df7e", "sighting--bb1438b3-fb97-48ba-82d6-7067f05c7817", "sighting--9d00d5d6-2a0f-4e53-8a56-5b5619a44ca6", "sighting--9064363e-a0b7-48cc-91c6-0b995b9cbc29", "sighting--ea20b34a-83a4-49a7-9474-667ad557c04d", "sighting--47d6a837-31c2-465e-aece-88d058132eb7", "sighting--1e53e881-f41d-455a-b32f-ad7acf1dafc5", "sighting--eb68dac7-1572-49d4-93fa-4ff093386085", "sighting--e8e0ab24-350e-4d88-aeae-d9a086e825d8", "sighting--94f6f306-d447-45e9-be3a-929f409186b4", "sighting--5df8425e-6da7-45a7-a2f1-3b1694b7f354", "sighting--d908b8b1-dcda-4c1f-987a-889fa5b54ff6", "sighting--f76494a4-0058-46a8-8afa-87567cf4ca91", "sighting--110b3ae4-4d32-4995-9e93-73651a70f142", "sighting--f21cf7f5-0abe-468e-9035-86ba3e03b056", "sighting--d5d8cddc-b584-4e5a-b169-e145bf956d2d", "sighting--71b06727-bf8a-45bc-a00d-28b0b457bf61", "sighting--dbf50caf-8e06-456e-844d-d234b97999ae", "sighting--c0f25486-83bf-4763-9b97-975949a1c7d1", "sighting--40a36de8-2a2d-40b1-9545-f1a4620fbcac", "sighting--18db9f73-c915-4e00-95af-fb8d1f5a1bc4", "sighting--036ff553-e378-453b-81d2-78faf50d0581", "sighting--e62e54de-f550-4d72-95e7-e5c4f1d95965", "sighting--75d8caf1-791d-40e4-b162-ac574e19df88", "sighting--96523db7-5f51-4305-8904-39e4d430ba80", "sighting--4177a441-c38c-4457-aa6e-34c7029595f8", "sighting--b832373f-96f7-4a39-9704-d08a6e16deee", "sighting--538d5810-2d10-4ddb-bead-e72cf2e2826c", "sighting--447ad0b4-6846-42f6-9fba-061bfc7b64ad", "sighting--18272b54-2171-471b-8f32-af89639e168a", "sighting--e12b9c75-ab36-42ee-b3e7-c9e1258f03db", "sighting--9fa22a0c-8db1-42ba-9002-dfb67c4ff360", "sighting--dfd6be93-255d-4e3c-a7a5-b37f2b959da5", "sighting--96c5d58b-44dc-4a75-b678-8fef4abfaea5", "sighting--667c0d29-9fa2-4061-a2bd-fda501c1ab2d", "sighting--ad53c344-b157-47fe-959f-65417aba42ea", "sighting--93bb1e61-4f7f-46e3-b4f2-1e70b4e83fbe", "sighting--d0cbc5d2-c2a9-44f7-b498-ea01faef20fd", "sighting--27124b75-c687-4611-a159-fc77de08bdf0", "sighting--e622810f-3db0-430f-8004-d77612b704fe", "sighting--8871e3d3-2992-4362-9003-b1ac43c111d4", "sighting--0c7ce3dd-c9ba-46d7-9163-454bfd7e9b79", "sighting--0dd78f43-0669-4861-a6d5-aec6694ed39f", "sighting--7a6e1abe-89be-4440-86dd-447d562e0ad0", "sighting--63608b7c-d0c6-422a-b094-91861ad0356a", "sighting--b93de2b4-693e-42e0-8e60-7ccbd89fc1ff", "sighting--9e33ddf2-33cb-475e-a371-c8384bc9e85f", "sighting--162a298f-ee83-404d-91ab-16aa70fc6a16", "sighting--7432e469-1015-4128-a18f-ceae23a74759", "sighting--c9265b50-e464-4222-a0f0-8a7539d6c3f0", "sighting--eaa43fb7-8da8-441e-9e06-67ab3668024a", "sighting--3f352b53-058c-45a1-8cb5-fec976562891", "sighting--d57975c8-276e-4c37-8d59-416867ebdc77", "sighting--8e23bf98-1e4c-4f67-8dbb-6ad050c71c38", "sighting--29a569d7-589c-4c53-884c-7ba2936a1b32", "sighting--fb9ecadf-bf84-4f94-a0b1-38cf0b8fe636", "sighting--b86ef5dc-1b69-4b93-af74-22bd5f57b247", "sighting--dbcd2478-0130-4141-970c-f79b9660dad2", "sighting--8d94ae96-f076-4590-9bb1-a8fcb16988fc", "sighting--296fcc45-403b-47e9-8d34-8d8f5a93c35f", "sighting--b795158b-6626-4d16-a6f1-b574838eae37", "sighting--31b4f7a8-c594-42e3-a648-2d2d9170fec2", "sighting--6cdf5552-03a2-48ba-876f-f197dd9752b0", "sighting--92b5d65e-230f-42cb-bf4a-4f79087bff50", "sighting--2d602645-b730-4371-b769-1ca6076d639f", "sighting--d92a0922-2ac6-4a4f-be5a-d28a5b231e8e", "sighting--355b66b5-918a-47e2-b875-45a4c6299548", "sighting--c8a9ba76-6fdb-4b29-98cd-008bc0e52262", "sighting--9d67d273-c868-4045-a15d-e92f2b5d40d2", "sighting--1647dadb-2dae-4931-a6ec-5a1b756090d7", "sighting--a5fcfa38-5245-4f4b-afc5-7091cbb95d77", "sighting--7006a21c-6585-41ec-a9cc-32dde97093f8", "sighting--517b52f6-1dd1-4577-a844-8fffa64b96de", "sighting--77171722-94b6-4c35-9d00-1772f856b69b", "sighting--091cf932-8d88-401d-9a84-f9079f241d68", "sighting--c54eadc4-293d-4d78-ad86-4da3007e5f12", "sighting--1f9143de-0c9f-451d-830c-bc0e8d9ecff4", "sighting--e9126d02-47c6-48f5-af3b-700eaa9886ad", "sighting--898ba671-7423-4881-ac53-ebeed4672938", "sighting--650c99d7-d20e-4758-b458-60f0e8e16f3e", "sighting--27956aa0-f2ab-4e15-8cac-be118d1ff813", "sighting--c26d4036-2f5c-4f07-995c-f5563ccfd905", "sighting--796a732a-a2df-4ef4-94a3-aa68016bdf6f", "sighting--ba141d3f-a479-456f-be42-05014a0926c7", "sighting--83ee8542-1f50-4dd1-a1b9-064b3d6d72b8", "sighting--dab48213-669e-4cec-a125-77983552cdcb", "sighting--78bca241-d339-45c6-b720-33643e557812", "sighting--bde08cbb-d70b-42aa-b0a5-43a1d2288754", "sighting--a049a431-e9be-4a1d-b344-ea62f1c42497", "sighting--3f572133-34f7-466e-b51a-d81acc418e70", "sighting--7e573b2f-f0cc-41d3-a009-883054e3b499", "sighting--d164ba0f-c989-4769-b450-93e8f8e45192", "sighting--1834871f-dd54-4351-b4d3-c46d67f46570", "sighting--ffe7e733-44a8-419a-aacc-9842ef80b4e3", "sighting--c450aaab-7521-4d3d-b222-b7570d8d8661", "sighting--d74766f0-157a-4d8e-ad90-fed29c81d2cc", "sighting--0fc48e0a-6449-49eb-affe-e787074d7fd0", "sighting--8139a1a6-ac82-4b50-8e31-57d5586de8ba", "sighting--e1e71c6d-fb2a-4562-9f30-8e470df47b77", "sighting--4bb214d8-4fc3-4915-89b7-1a50747cb9f0", "sighting--798d9572-089f-48cd-a4f5-24890808c3b1", "sighting--e596e70e-0f72-4c93-a1e8-3d464207f16b", "sighting--39f68baa-3740-4c22-8058-a15c2ea706d1", "sighting--7a6f641f-153d-4c94-90d3-53ad7f0dacce", "sighting--49f80905-123d-4ee0-9b21-835af635965d", "sighting--caeb1fdc-329f-44ea-ae64-8bead28b38d8", "sighting--3323caee-75e5-4417-bd1a-65c4071e603a", "sighting--32601d74-c553-4b7a-a74f-2e5d3a653fc2", "sighting--13ad9ff8-ef55-46ba-bdb9-fc62a2d582d1", "sighting--064c9ff6-8be2-4b2c-abef-cdc0422fce5e", "sighting--9b33e6ac-f2f9-4788-9d5b-38e9e80beab8", "sighting--dbedce4f-b228-49c1-a837-68b14232bda0", "sighting--f1a85eb0-b87c-49c0-805e-9fae7e30b626", "sighting--9385d1dc-f9f9-4637-b3c0-5268442e5c71", "sighting--0ef91192-25ab-46a7-9fa5-8eb19f5a0cd1", "sighting--5fb129e9-1a86-4b61-9578-e376665e4d91", "sighting--e231d6a2-2888-4d25-b053-b681082990d9", "sighting--6a60cd81-7b0c-468f-8bce-82c9c595191b", "sighting--03b13325-03af-4eab-ae03-401e65357a74", "sighting--ff57fef3-1914-40ab-ab31-13fc807f6bf4", "sighting--084df6dc-b481-4da0-8891-dd22edabe120", "sighting--581d5b6e-f1bf-4773-ae26-9642c339b97d", "sighting--7e4b775c-b2d7-424a-a8e5-b3f61a20fb35", "sighting--cbf6b707-da3f-4ed6-8384-b7bf3fe85e58", "sighting--95f95925-2413-497f-ab1c-b1388fefe21b", "sighting--3d4d2a3e-0461-4873-b757-5807c9b445c2", "sighting--bd5f8d95-4060-4c82-9db5-4ee2ffef3976", "sighting--b958c432-3166-47c3-b3cd-11134a7206d4", "sighting--c09aa3d8-c2a6-4f30-9e7f-e35e211b15cc", "sighting--3d87aa76-38e6-476e-98e8-a32668243ae9", "sighting--81880a5f-d52b-4997-ab6d-c5e7788d1d14", "sighting--270e26ad-356e-49a7-8ad6-6fc0b4d6ed24", "sighting--446927b6-d16d-4035-a6fc-6ea9a4ad9785", "sighting--61f1e8f9-54a6-4894-9b07-e7797bd99504", "sighting--6608ff5f-1450-433a-add9-1b21f4c2b938", "sighting--a618cdef-7803-4c78-9862-45c0c4441e6a", "sighting--3caff918-c8ea-4960-83e0-985b3ec31fc0", "sighting--5022f007-f1b9-4066-bb3c-f87e47b18820", "sighting--a8075a0f-c727-4d0c-a814-f5028ae0c30c", "sighting--a5bfdfba-4ba0-4581-bc22-9bfb4a3f7d36", "sighting--d7e6adba-e7b9-4bd3-aaaa-3c512e98ebb3", "sighting--06af581f-8b41-464d-a698-15d1100e7ba3", "sighting--463b32df-675b-4506-a472-7b450ffd69b9", "sighting--14a00ee7-4177-4954-8f65-b082629d4b0a", "sighting--ac2df204-4f55-4554-97b3-0f7781885c13", "sighting--cdfc9972-e46a-40b8-ab4d-c9f8e052fcf0", "sighting--96e9a670-ed46-4282-a2f8-e039a69e2650", "sighting--4c59f40e-9b2c-46b4-a851-c36836455a3f", "sighting--d93f5b95-5ad1-4b2b-9f1e-33074a4ba669", "sighting--633cff1f-6ef6-4e7e-a190-bb3176802244", "sighting--975d44c0-16e2-4160-a7dd-534c96b2ef02", "sighting--b8b09888-504d-4793-9299-8187a7ce6d46", "sighting--a096c827-613f-4b0b-bff6-c5e0655f0186", "sighting--9a3a2805-a9f1-4139-93b5-06d40a36171d", "sighting--169213a9-a66c-4725-a906-5801d7e77bf8", "sighting--9eed2bc5-77c2-45e6-adad-1ad89bfcb51a", "sighting--1cb0e8c8-e0eb-44af-90c8-c9f5bb67fc85", "sighting--5bc6f166-4cee-4016-93e8-ba25153a2bfa", "sighting--6e212833-6885-40c8-b64b-69da7afb24cd", "sighting--1275c353-103b-4d6f-8ff6-cd323c2436ea", "sighting--3fb0ded8-ddf5-414c-8132-52c7a438b54a", "sighting--4dd8e718-21cb-45c1-8804-aeade6dd6914", "sighting--199625c3-90f7-4833-aa78-f360ddf5ce4b", "sighting--9353bb54-c452-4bd8-8573-8124d434c02c", "sighting--cbdaf8ac-9cd9-4f32-bc55-907369e948b9", "sighting--28a48e14-c7ea-41b9-a72c-9871621d4e80", "sighting--c3fd0147-d34f-4aba-a5a7-9afc346b5338", "sighting--b2d2aa80-2fa6-45a9-8d3c-6eb1c5350887", "sighting--bc05506d-39fe-468c-b520-95f6a83e0e9e", "sighting--f39f2bfb-9ca4-4c37-9f4b-df4b881c9a3d", "sighting--7cd5d1d4-6ce1-466b-8339-0bc83ac5fea5", "sighting--76c32269-5045-459b-806c-c83c7de4c0ee", "sighting--d06979b6-5d9f-4409-9c0f-815c21f4255a", "sighting--3a1267b5-09d5-40a4-9afd-83a3711121a8", "sighting--4e299484-284f-4e58-b6b1-7ef7c5016b92", "sighting--70f4327b-a2ea-4d51-9c6f-5925fc03dd85", "sighting--4d99d306-9810-45d2-bcb6-e90922244948", "sighting--11efaec8-c43c-49cd-935f-a027d918c7c5", "sighting--d747f1af-a779-4a84-9022-99676fe43f85", "sighting--c09979e7-2214-4df3-964b-f6abbed0b71b", "sighting--adbc8ee0-b086-478a-9030-11256e6d8083", "sighting--460a2c47-974c-4849-a67b-e88df28733a9", "sighting--e211f5c7-850d-43f2-bd0b-8ef901c0c6ce", "sighting--bc236dd3-b012-46d4-8f6e-72da5c102847", "sighting--2ec2fd54-80d4-493b-877e-dae35c81c615", "sighting--06d338b3-11ac-418e-ae46-a646c55efc81", "sighting--ecf98220-36c5-46f5-a153-1cb32e35d935", "sighting--6cbfd373-5ca3-4ad6-9133-33604037d97e", "sighting--58e67eec-5048-4ae8-be00-6f3040d54ecd", "sighting--04fbab03-470e-4011-981f-8786ebcd9263", "sighting--2b82554d-d39a-4dcb-b425-df0775265f5b", "sighting--bf9cb227-dfe6-404a-9765-9606d70c07d3", "sighting--061b0386-fcd6-47b4-ab27-1968878100f6", "sighting--d1dbeee2-8cae-4f06-8109-bdf380a52b0c", "sighting--1933f90d-a4b2-44f9-8af8-59ae2a6c2ac9", "sighting--2ee00494-4c5a-4ddd-a4a5-8ee774bd940c", "sighting--c76f90e3-0afa-4fed-94ff-b716da21c74c", "sighting--622d23ef-2068-4eb6-98d7-a63f9c2ce0cc", "sighting--cddcc49e-98e3-430b-80f9-eaee06aaf04e", "sighting--a289a46c-21ed-4323-ae42-39338a5491da", "sighting--f6701f89-1303-4df7-8d29-379ad2c0c234", "sighting--de2d94de-838c-486a-8ca3-5f049d4115d4", "sighting--002be9ba-2068-4bf3-a3a9-c8e72844ab65", "sighting--49cd1417-1c5c-427b-ba68-10ffa41d01bd", "sighting--26bd87d2-dbb4-4582-8499-4329d408f2c7", "sighting--ff661647-bb4a-4364-8bc5-10c7dab1a07c", "sighting--9d0c46c4-2a3d-4996-9ab4-737dbb01bbfb", "sighting--1fe7dc4e-a1df-4c7f-9279-7021cf544f28", "sighting--a5eaab50-001a-4512-8896-db45e006ce6f", "sighting--febb2b74-1f72-4473-8e14-93edf59f8822", "sighting--3d3c889f-a4bd-4c5b-b41b-280e7f8fa791", "sighting--31a50d4b-8c38-4723-9b7b-9f39afb3ee74", "sighting--2e39ebca-3149-4e2e-b53b-99f06fb2839d", "sighting--036c8b77-c256-4a34-94d8-e7f5b9e5e7aa", "sighting--c7567420-1dc6-4c74-a597-07f99e619b07", "sighting--3eb74fd9-8aa3-4b9e-9562-8ba6451a800a", "sighting--2eb4edf4-6509-4ebf-bcf9-af8a6b03d229", "sighting--292e6654-ba0e-4d3d-b1c4-1a2a6e3472bc", "sighting--836537a2-14c2-4589-a359-e82d4e59d2c6", "sighting--b1709837-5fc2-44cd-9c0a-5551b78d5d4c", "sighting--f5051acb-3301-4069-aa85-19e5e6c12483", "sighting--bc098a86-e204-42c6-a1f6-ae8a7b97e3f7", "sighting--acb477e9-1523-4ed4-9aca-8aaaeb1889dd", "sighting--99d9d7b2-7da7-49bb-b322-8896e4d2db3d", "sighting--c45ea6fe-1432-4a36-b8f2-ef6ba4d72641", "sighting--fec0f8ce-fae1-4ea2-be0d-ba7fe7457fe3", "sighting--c00412bc-51ec-46b9-9bd3-207e77faf0a6", "sighting--78db39db-89e3-466d-aef8-aad38c5a9f4d", "sighting--e5441609-e6d4-41ad-bba8-f29ea4eb3786", "sighting--697d0dcc-613c-48af-a20c-5e559710a44b", "sighting--0ecb1df5-a4ba-4900-8178-9d629caa7a6b", "sighting--8e824aa2-722a-4070-9d2d-9d7799b35680", "sighting--c0303500-2def-4703-aaa9-346d90e262c0", "sighting--cbc98594-02f7-4113-9258-9aa066426840", "sighting--5b45b1e7-904f-41ac-b066-b784f0627a30", "sighting--941aca80-5cce-47ce-b9b4-ffd36df4bee0", "sighting--a146f75a-f392-44ee-9941-606f2f7584a3", "sighting--a306bf69-cb5e-4743-b685-d185ad92ab47", "sighting--54fbfa9e-79a1-411f-b760-ee7e461422eb", "sighting--acf415eb-b0f7-4d0a-a978-83753781486e", "sighting--3db058f7-3f73-4e5e-850d-6160491d9f54", "sighting--91cb323b-ec71-4421-9c94-101b54096521", "sighting--e2e9f4e0-4036-4606-824c-193d88f767dd", "sighting--b768db71-9815-40c5-afc2-272d3bcf2b4d", "sighting--b39c86f8-a208-4801-8386-fee3cbeb84b7", "sighting--ed4ce1f3-c777-4081-84a1-7d595ba04fcc", "sighting--3428783c-4c11-45e9-b13d-e2383a42ad34", "sighting--557a9bb7-e1bd-4a01-8f9a-a312b677c72c", "sighting--e15b8689-b0d8-4376-8e9f-e41240463ba5", "sighting--60ab0ace-5fd9-4cca-a73f-c60be8f33b65", "sighting--639cc80b-81b1-4740-b925-ce262568e585", "sighting--c715afbc-4318-4c55-a6d6-4d76da48ebb4", "sighting--b280cee2-6ddb-479a-b8a4-1937dd781972", "sighting--b16ec5c7-7f4c-4e24-8ad9-14f24060909f", "sighting--2a61b3b7-884b-49f2-914b-e542a07e4d5e", "sighting--39d2c7ec-295a-42a4-9a5c-cee7cc2108a9", "sighting--3451068a-707d-4254-90c5-0430a6cdb90b", "sighting--31eac035-2393-4f28-9b29-4f5c20616210", "sighting--b7e0c835-286e-4e56-80d0-36558da6a5a9", "sighting--7625a4dc-ec07-4d34-9d98-031d34c0c8b5", "sighting--16ae425a-d228-4ad4-9672-b53146a30fe7", "sighting--8c64a247-6f70-4597-8e6e-8e01e188f7dd", "sighting--eb222db7-78e1-472e-ba06-da89dda8eece", "sighting--c93a8a62-594e-4b86-a0c1-31dd497870fc", "sighting--767264da-de77-45c7-b03a-53d01c3ccf01", "sighting--06b65abf-aee3-49f7-b26c-9e85f2490863", "sighting--c87e2ced-2acb-438e-9f82-689455cb74ee", "sighting--5ec7629c-4ec9-4d38-87b3-0e89bf187b96", "sighting--ac85be74-0759-4674-a1d2-92995e56f6ec", "sighting--f865dffe-6840-477a-b15c-db9e279787b7", "sighting--fe156711-3c25-4335-bbf5-97156ed126bf", "sighting--88b867a0-2d29-4c9e-b012-57ef6fbd6b47", "sighting--e7156dbc-7b87-48b2-bccf-9abe5eda3255", "sighting--05aaf4b4-4f3c-4da5-88ea-4b3d30f0ad28", "sighting--01403897-0ff5-484d-8e01-cf09df2bcdbd", "sighting--98b3f9ec-90fe-441a-ad49-3c6aef55ef6d", "sighting--3507e452-2b5f-4711-ac35-dcffa578dc59", "sighting--0075c831-2398-4a3a-bd4f-b31280c9e357", "sighting--4fb90571-f19e-4925-afe1-e3bfedd015a0", "sighting--55988db6-6a9f-418d-88f5-1788b214920e", "sighting--1a605690-f30d-429f-be4a-dfd149c1b1d4", "sighting--93ccf996-3303-41d9-8f14-8f068d1cb397", "sighting--210d26e4-69f0-49ab-8054-1e952fd2f9e6", "sighting--fd77bbb9-3005-4557-b883-57a228ad72d2", "sighting--d811eae5-8bf8-4377-bb33-ac764a60654a", "sighting--56969d75-0bc6-4829-97b3-a4ef1f9c1d8c", "sighting--e7b387e4-d888-481a-945a-5e05b8df2459", "sighting--ae241a0c-ebcd-400e-b8bd-56fbaf6014d0", "sighting--bdf865ca-0e60-44f8-9955-1bfbb0b5b03e", "sighting--7d5a2b15-43be-45bd-ab1f-ab5e79999a7d", "sighting--a77c57aa-0cdd-48be-87db-acad9c818719", "sighting--9a5463dc-eef3-475c-9d43-117cc63b1f1b", "sighting--7975e505-a3f4-417b-b0e9-99369c99c1a4", "sighting--f939137a-e2f1-42bb-b977-7aa67d2cfd43", "sighting--e6dfd408-e868-4f3a-b249-569492f9597e", "sighting--a104abb2-867a-4462-90b7-35601373d613", "sighting--238dec5b-1750-4cf8-9f39-18f618ef23e8", "sighting--67d96492-5720-40c9-8edc-9f723c841b04", "sighting--0c27306d-085c-445f-ae77-e80b1edbd65c", "sighting--348e0488-6f0f-460c-bdba-e91ae8629064", "sighting--68829096-db93-484e-9104-05efd8d0dc55", "sighting--04406160-8c99-40b2-8fe5-b84460b3da04", "sighting--63b74b2d-25f8-43b9-9276-537d3dfc048c", "sighting--8c66c794-d685-45bf-b5df-a2273e19bbca", "sighting--d292a583-684f-41cd-a097-2dcb1614a553", "sighting--7a747ae5-cbfb-4aa7-9494-5628927d44ba", "sighting--80b0ebdc-245e-4312-9d6d-28fd4f06acfd", "sighting--4670eb3c-7146-4009-b926-2a7a54d7e7ed", "sighting--2d2b51f9-747a-4bdb-b5df-26f77f2b662c", "sighting--cd1b7bff-f899-4115-8df6-3061092414ef", "sighting--82c68381-389d-4144-ba2c-4a8f7e1877ad", "sighting--7286a4a8-4f9d-4dd5-b649-8225a062de91", "sighting--ea4975a3-433d-422d-a976-bc5bf837fa2a", "sighting--2c7afc4a-2063-4e13-8df1-45e8b5f0168a", "sighting--7dcb6e7c-e460-44ab-931a-28db2e6ca878", "sighting--825d686d-8ff4-4ea3-9fcc-89af8428aa93", "sighting--8007a5d9-4182-4b18-8dbf-70b64d1c42c7", "sighting--76da53ec-c5f7-47f6-9995-de0c23b67f7a", "sighting--521a5559-12d7-4cd8-ace5-5789ea3eec57", "sighting--814e8d16-71e6-4f8d-baac-70250a456df9", "sighting--63c67ee3-2fce-49f5-8c0e-56d7d7f54e96", "sighting--584a903d-801b-4007-a1ed-6696ef104fb6", "sighting--7f1466e2-2f84-4461-8aab-0d9628c6a46a", "sighting--08825a65-78a4-4db8-b0fb-87de31e5bd50", "sighting--7b7401cf-1e4b-4205-b32a-5cb1b6aaa7e6", "sighting--3cd77df8-c0b0-492f-9c4c-7a7545832ffc", "sighting--24020e65-7489-4e9d-ace9-4446cc82704b", "sighting--1740dec8-3e74-4160-90c3-42591aace16b", "sighting--f6691c61-c11e-469f-aef5-8a9b29b6f8a1", "sighting--5aad4b93-d1c2-4c4d-83a8-e3b49488f78a", "sighting--5157719d-9cef-4d33-a48a-3f11ab5e5716", "sighting--aed530ef-098f-44ce-be98-26a29e549c13", "sighting--065542f6-5216-42de-847c-a572a88d1ce7", "sighting--826a2458-5247-4b50-b6f1-bdaf8447a089", "sighting--e9220615-ca0d-48a6-9a4e-2a15d03ef1d4", "sighting--f62fdf9f-de71-4dcd-b88f-76ca954a5b83", "sighting--8323a1a1-adc3-4890-b7aa-3b69724d38cf", "sighting--d65ec872-ec2e-4c10-9d69-e20a1c1bef79", "sighting--934b2de6-c671-4314-8101-4454b7324925", "sighting--574f9844-dfde-4490-b6ce-dd91302817ab", "sighting--e0172440-b277-419f-a9d2-bc5e360cab92", "sighting--ab9a58e4-b73d-4308-a00d-ef499a6265f7", "sighting--c95039a7-52d1-460d-af80-9644668ba197", "sighting--1479e6b1-97a8-4dbf-983e-033f169406a1", "sighting--18f2d09e-e9ad-4c2a-b271-58fe3d7687cc", "sighting--3b42689e-e1bf-4f1b-a703-f5719869c7cf", "sighting--0868ad47-a95b-4135-9be8-35f141dd69f1", "sighting--c9abbbe5-6cb6-4b36-b836-b3043abd6038", "sighting--7dfbf1b3-5b3e-48d0-be3b-9d5456bc2a70", "sighting--128216dd-8915-43e9-bf3d-939f6fb34078", "sighting--49c66d01-9668-48fa-abd3-971f9d7d9186", "sighting--3f98e482-568e-4e0c-979b-3923040567cf", "sighting--79d84b93-abe5-4ef6-8496-6e1128c67329", "sighting--4408d733-2fd8-4059-9fc3-aa4138b8a88f", "sighting--f59c9529-f371-4277-b2b1-e754f930cdc0", "sighting--36aa6d91-8049-49fc-bbd3-f03d5d16c7e7", "sighting--4c164d12-8436-41fe-89b5-85e724712fa7", "sighting--d29ec2fd-398c-45ea-9734-d836eee4de31", "sighting--539141f0-a317-49a9-86a9-04b3e3ab7882", "sighting--4f3ab105-7f78-44ca-8458-333351c4ea44", "sighting--9ab4ddd3-3cb8-477c-908e-277337097f63", "sighting--3974c990-5ec0-4ad1-ab3b-955a88541471", "sighting--11d977f0-264b-4cb3-aadb-7fae5215ab5c", "sighting--2689961b-c42f-4069-9beb-86723519fdcf", "sighting--aad46ad8-9ed4-4564-8314-baf0ae1ea0b5", "sighting--762d6057-7a49-4948-bb85-140372ac118c", "sighting--2e357a03-4d72-4d76-a59c-6e5201d36044", "sighting--e102aa34-432c-4527-99de-7212e5a115c7", "sighting--b1d26b36-2306-433f-b7e7-bb1c18ff753a", "sighting--fdaee7cc-c623-4ce2-ab3a-287e29aa3f22", "sighting--44dc9b0f-16a3-44c0-9ad4-23cdad87f047", "sighting--a7df0159-e5ab-4599-a4b4-5c5c83405f08", "sighting--4ff8fa53-2a06-48f7-b4bd-7624a03f5d9c", "sighting--9436d35d-1a5a-4283-9b62-c1c357b9f46a", "sighting--9c7c68ff-8f50-4968-bfb4-24ab206af933", "sighting--1e1601a2-9aa3-4fe2-863a-613abc286887", "sighting--c04f00a7-3613-47bb-a88d-0f8dea97e6d6", "sighting--ac3b3515-d3a1-4b36-bc02-04e1f5543366", "sighting--ff3e06ce-8242-46ff-9cad-23e16cb69bc3", "sighting--9a16abea-3b03-449f-915b-0edd5a83bad3", "sighting--533bd5ba-f22e-4963-a45f-7ac9998cceae", "sighting--5c9d9751-1067-4541-9d1b-fc9e538fa2ea", "sighting--fd5b14f4-8c90-4b73-9634-7ea81c415b20", "sighting--52ae46f1-f02f-45aa-8031-ec2a12433599", "sighting--cc732a0b-0424-4113-8ef6-93e0bfa52b22", "sighting--3fa8c47c-098c-4e72-a258-4db9cbd16fe9", "sighting--bc05b26d-8ad7-43ba-be71-93352504a787", "sighting--822f585c-0768-4d07-8301-e1909ea13557", "sighting--4bf32d96-779b-4eb6-8b12-d4e31090455b", "sighting--095c887c-5af2-4cae-aa2f-d76942500aef", "sighting--d4c2d68e-2073-4610-b126-f31edf4f3ba4", "sighting--813738da-ae11-4105-8a2e-1130d6477db1", "sighting--6e9bdaab-be38-4172-a4bb-7caf039b8f6f", "sighting--cb545477-dd71-41f5-a7e2-ca8735a7cf6d", "sighting--4ac16d60-0517-4e5e-8a4a-b825195a9d80", "sighting--208f4fe9-6104-42e3-abd2-6c08efc8e8e3", "sighting--2aabef60-82b8-43b5-a415-ddd4cb290cd5", "sighting--04d05cd5-9f0c-4c9a-8923-41e369489391", "sighting--b6c0c99f-cf95-45d5-b45e-7e9baf3884a5", "sighting--6a27af81-8e05-46e2-8dc7-613b74083796", "sighting--ce94ced5-04a2-4b0b-84e9-876179a7c2a0", "sighting--fc573dba-c4c2-4ef5-87e9-78962ceeec6f", "sighting--6adf5cf5-14cb-4301-ad54-a0694cbe3be2", "sighting--7628d679-ee5f-451d-bcd1-795c59b40824", "sighting--964800ae-45f5-467e-96e4-2530492b6280", "sighting--96ea4fbe-368d-43e5-a798-080d1171b4f8", "sighting--adcaf515-31c9-4739-909f-e1f463e8a74e", "sighting--1d7fb565-1b46-4122-b08b-97436c1d7414", "sighting--23c81214-5396-4e85-8fc3-956733e042b1", "sighting--fe1c2eb6-8fea-4636-bfa4-b6622309c6e5", "sighting--9f8d76f9-b7fe-4426-9a63-d27c2f5a96a1", "sighting--61ca14bd-a7ff-48db-bb5c-2a32c2d9bcb7", "sighting--9ed381bb-cd3a-47c1-8395-5df38af1b3ee", "sighting--95e69dbf-89e8-4451-ae7f-2b1121cd2b63", "sighting--32334d21-0acd-4e38-b961-c4b23a45add0", "sighting--a84d38a4-664b-4414-a37f-0e263a0b6ea0", "sighting--c95ae86d-1c6c-473c-bd1a-719d1c738a45", "sighting--ff2dd873-90ec-4bc7-a79d-082d96165520", "sighting--818f0540-463a-4f80-afdc-d0d670b53720", "sighting--51241a94-35b5-41ab-bc39-75998ae7f6fc", "sighting--2a88f210-3d67-4c0d-a6a8-47d70919dd9d", "sighting--9a71f3f0-3b5d-4f1c-a591-800efc4b4dab", "sighting--13a5b62b-340f-4991-a1a9-3a85f65f913d", "sighting--f6902a50-3a97-4bf4-8a8d-a1846bb43da4", "sighting--8292e9b7-61e1-4c5e-90b5-cf5a16c3920f", "sighting--37fde53a-f603-4ace-91e6-4a67d058ea19", "sighting--a8aba42d-2751-4975-ac92-e11962e530a3", "sighting--dcfc71bd-2a5e-4607-afe3-6bdaa8f0c16d", "sighting--0ee921ea-c581-49b6-b2cd-643ba9ef1dba", "sighting--7c9372c6-ef8c-4e17-9d54-42f292eda792", "sighting--2991d29a-1248-40eb-84f4-b815dc949723", "sighting--11878167-10a3-4655-9ce5-e83932e6f3a8"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-12T11:00:01.514Z", "modified": "2026-10-12T11:00:01.514Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}