{"type": "bundle", "id": "bundle--0c91642d-5b3f-4ca5-99d0-61f2f8801618", "objects": [{"type": "identity", "spec_version": "2.1", "id": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "name": "James Brine", "identity_class": "individual", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "location", "spec_version": "2.1", "id": "location--c557d622-0532-4fef-abb9-e1ed0aa25de3", "name": "DigitalOcean London", "latitude": 51.5177, "longitude": -0.6215, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "GB"}, {"type": "location", "spec_version": "2.1", "id": "location--03af0950-5030-4b13-8b71-7df482530f16", "name": "Reverse Proxy (Perth)", "latitude": -31.9505, "longitude": 115.8605, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "AU"}, {"type": "location", "spec_version": "2.1", "id": "location--b6773cad-9f61-4f46-a3c0-170f379ed49c", "name": "Vultr Tokyo", "latitude": 35.6762, "longitude": 139.6503, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"], "country": "JP"}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--4ba1f9aa-20a4-448e-b71d-aeaaf8d6f900", "name": "Cloudflare Global Edge", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--c5e93506-48a0-4864-80f3-5e534b3f822b", "name": "DigitalOcean London", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1bf9cce4-2e64-45a0-b78d-c232980fef57", "relationship_type": "located-at", "source_ref": "infrastructure--c5e93506-48a0-4864-80f3-5e534b3f822b", "target_ref": "location--c557d622-0532-4fef-abb9-e1ed0aa25de3", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--9e78a371-9b3b-43cb-bea4-248f4742aaa9", "name": "OpenCLAW Dashboard Decoy", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--c55a0b03-342d-4ce8-9880-e858f441b3e4", "name": "Reverse Proxy (Perth)", "infrastructure_types": ["firewall"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ab7c6897-c862-40f7-b498-1f7056cfa82a", "relationship_type": "located-at", "source_ref": "infrastructure--c55a0b03-342d-4ce8-9880-e858f441b3e4", "target_ref": "location--03af0950-5030-4b13-8b71-7df482530f16", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--c94832fd-b247-4900-b1df-eadc04a9bbcb", "name": "Vultr Tokyo", "infrastructure_types": ["honeypot"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b0b645b3-4c15-40ad-97a6-4dc95d8c8025", "relationship_type": "located-at", "source_ref": "infrastructure--c94832fd-b247-4900-b1df-eadc04a9bbcb", "target_ref": "location--b6773cad-9f61-4f46-a3c0-170f379ed49c", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--651e8076-98c7-440a-b8fc-79814d7f4cff", "name": "CVE-2002-0953", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "name": "CVE-2002-1149", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--df0714f3-8905-4b38-81ab-0ec5476291c1", "name": "CVE-2019-0193", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "name": "CVE-2019-5418", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "name": "CVE-2021-26855", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "name": "CVE-2021-34473", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "name": "CVE-2022-22274", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "name": "CVE-2022-22947", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "name": "CVE-2023-0656", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--322c2286-6e9c-4af2-ba5f-bf956a058e85", "name": "CVE-2023-1389", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--df006803-2730-4832-af24-801eeaf41481", "name": "CVE-2024-23692", "external_references": [{"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692", "external_id": "CVE-2024-23692"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "name": "Network Service Scanning", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1046/", "external_id": "T1046"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "name": "Exploit Public-Facing Application", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1190/", "external_id": "T1190"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "name": "Credentials in Files", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/001/", "external_id": "T1552.001"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "name": "Cloud Instance Metadata API", "external_references": [{"source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1552/005/", "external_id": "T1552.005"}], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a74cae5-506e-4c96-8a17-e4d5643d42e2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.12.70.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b136fe2-e68b-4081-9ca0-816c315cb9bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.52.172.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--273e7123-f0b9-4e62-8c82-aa2762d9e775", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.92.202.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a5c9cc6-af8a-4314-a255-8f010b1c77ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '1.92.207.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0feb658-de21-4b16-9c29-773550967fa8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.246.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5531bfe-66a5-44d1-84c2-d40777ddcef8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.36.136']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--195f0b17-1ec4-477e-a8a6-14142edb6877", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.54.226']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f77d30a6-94eb-4198-8723-534b6893c4ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.32.8.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5de6251-edeb-446e-abca-3fa6dd863713", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.42.33.137']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d09af14-6143-410e-a52e-ab97cb4c614c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '101.96.202.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f70afcb-1f24-4bd2-85d5-cb071de6dc36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.129.75.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bc067b1-402c-4f2d-a916-e9c9847955e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.156.37.45']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4077466c-f49f-430c-8eda-67dfdd7368d8", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '102.220.160.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7c9962c-f9cb-4b3e-a4e8-c73b64738ae4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.64.163.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--636babeb-02c2-4259-a820-9e37c0ff21c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.70.101.86']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d20ac8-1bad-45dd-8d13-03ee79d593a1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.137.213']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44ccfabc-c895-4da4-97bc-e551f49a639b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '102.88.137.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b1a3798-0024-4dfd-aba4-6546b9250a7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.102.159.195']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4099919-a3b4-41ae-a106-6ef4fa1c612a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.117.145.130']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e67f2e49-b587-4aef-897e-546bf572ab9d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.143.239.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce54219c-952a-423a-b571-9b06b3248104", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.152.213.142']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4365f12c-0aa1-4c68-b150-871d8cb89950", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.163.67.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a6bcd0a-1c73-4648-98a8-51a2f6de2a63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.234.202.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--640d2b6a-2061-456b-a04a-015d1fb7da6c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.241.43.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5008bbd2-7ec0-4f3d-b84d-ada84e6b433a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.249.22.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4c96478-eff1-44af-9c2c-6543ede82e21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.26.80.1']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e87f55e-c674-4c44-ad00-d56e4d467227", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.35.211.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9be30c2b-7189-43e9-94e6-11d5f0acde00", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.53.158.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d352620-30b9-495c-8977-20192256aa19", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.66.149.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9778319-f61a-402d-84f9-13985cda0183", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.69.96.120']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060f28b8-4e27-46c2-a786-a25ddccc2ee7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '103.89.136.111']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a62858-5b33-44ae-948b-99da7fbee0af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.196.108.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d6cc333e-1163-443a-b58e-832c09faa80f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.199.172.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6a7e2f8-873c-491b-a9e8-bd1e05ebf8d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.208.108.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3774059-0c0e-4a80-a908-11c9e006a229", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.253.228.1']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fed11ab4-5a6a-4d0d-9d6f-0b905cefa2d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.201.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9830a89b-100a-4eea-8684-4a91933f1a1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.28.201.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47aa6aff-4edc-41db-86c8-2df9b5697445", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '104.37.185.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec58066b-dc20-4b14-a605-ddbafeb32b0b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.118.5.247']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be968095-4e94-41f6-8770-7893fea617ba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.157.131.108']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d172290-6155-4beb-9a6c-99adcbcfe363", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.165.77.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ea7698d-b5ba-4589-b43c-c1cb648c4268", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.188.55.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0b4e2d1-7c98-4668-bb79-0b90f65e95e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '105.245.28.236']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6603f939-4053-447b-b194-b15d68da9672", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.12.51.76']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b9362b-1486-4115-84c3-d70aed1883a8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.243.155.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28edb24c-9beb-442f-862f-70747ad2cabc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '106.52.171.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c13ce4a7-9df5-44a6-868a-db83d3d1f6f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.12.46.169']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--101f60e7-bf03-4a82-8b3b-123d2d5199d4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '107.173.236.243']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56f8510b-d035-45e6-b4fb-c00a70ee7ff4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.131.22.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4fd0d92-fc18-4b7b-8752-e105141c98af", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '108.174.156.122']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--150fba5f-61a9-4ba2-a5f5-aeefe8cc28e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.107.224.244']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--995f6651-e714-47ee-8923-817ec092095e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.136.56.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c94593ea-040c-49f7-a7b1-1f34eaba823f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.110']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--208e4b96-3d8b-47c5-802a-79d8899106eb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e7a798b-0876-4782-8ded-aa5b813a7e05", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e732b0c6-dfd2-46c6-8081-1299e323dcea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7df08a0c-af0c-4dea-9eab-460444744cb8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.160.32.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--947eb785-1d18-47d0-8123-096f62a33fef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '109.196.194.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2774b25-6065-46b1-9357-482c3ebef62c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '110.38.181.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a8f027a3-e671-4ff3-83ef-ebda1a37ed41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.119.34.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fd797057-18b8-4566-a53c-6fc8bc1efed2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.77.93.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--24d68cc7-82e3-4858-a6ac-067218384e86", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '111.92.157.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37c08c93-97ec-4559-a053-700f438f7941", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '112.86.225.185']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9e5fe9b-d036-4fa0-8eaf-435f2934f7f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '113.173.8.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--878d75d4-e32a-44da-9d2d-f92f3e6d8103", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.131.90']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2804ee1-a27b-4a86-859f-16d28df05850", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--394ea9ff-562b-4adf-a60a-d6bc24686048", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.232']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f10b76-7c7a-4074-a825-cf109285ed34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.137.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae028069-4a8b-418a-b5ef-bb27879310d9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.206']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46e16773-17c5-4c5a-8f2f-d998a4357894", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.140.250']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bedbc3d1-d53e-4011-b1c4-e4d4fe6a5e64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.142.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--069ae35a-de0d-4184-bace-27378d0ca391", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.126']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bb20872-21ba-498b-a8a1-d6f082a1d993", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.151.219']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--df7de67a-ae46-4ccb-86d1-80a8889aac7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.152.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--914b596f-248c-4441-a084-4ec9c84e58ca", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.153.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c0d4c11-57ad-4b9f-9b36-aa5ae0095044", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.210']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e79c3a10-a37e-4cda-a0c8-45b709a4c3eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.155.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8e6ac339-cce5-4397-9fed-b960934d6137", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.119.159.8']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116f8141-d907-45f9-a4f9-8d89dbd602d6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '114.33.112.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4aae9c7f-dd66-4f91-aaaf-9c95efa5ee4f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.229.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a498e58-c999-4809-a4d9-45728a2ebda7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.235.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--575995ea-8a89-4c06-9216-1a57bc050632", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.245.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7e00a9c6-f6a2-4003-a49e-577beca8c1bc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.190.253.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0af3d0ad-e563-4c61-9405-a3716341b5f8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.74.7.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4774263-d32f-4006-8f52-b7db7a702c23", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '115.79.192.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--804b98a3-3d64-4f23-a50b-5e06e71702de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb5d593e-f564-4e32-b6ea-852037dcc196", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.179.32.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f148ff5c-8b56-469e-92f4-012b66913778", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.204.104.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87333289-fd9b-41eb-9573-9d6329cb5562", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.49.193.202']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ab9ad7f-c620-4588-9003-8210e201182a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '116.98.246.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b0354ef-97c4-4369-9a30-898aba142511", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '117.6.44.221']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb4af4c2-582f-4861-be4c-85a101f37fde", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '118.145.114.113']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b46a870-2125-4e9f-b18f-b6db8fa65ee6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.160.178.238']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42ae1522-c41e-43cb-bf3e-c1b1e928fd51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.160.2.82']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1305aa5-a38b-48c9-8141-998ba19968d8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.28.92.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43c9f478-176e-4146-814d-a8b9d718d5e0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.63.138.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e576341-4948-4680-b55b-de89a84c92af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.8.41.86']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4cfa277-8a20-4377-9f1c-412e0d348752", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '119.96.157.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cea6b492-9628-4893-9243-de0cb051e54c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '120.48.38.253']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5350e89-a24d-4569-aa03-a616e29b9c4b", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.168.54.210']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3976900b-ed17-46fe-b1c5-666f45107fd8", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.191.167.81']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d077071-87e6-4328-b252-61233578cde4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '121.37.104.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f600c33-c7ea-45e1-876b-8d501b4de5cd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.168.123.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dbc70084-db50-4d71-9802-dd4a620dd2a2", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '122.202.41.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2bcfb43-ccb7-4f25-ae0a-ddec9e76f749", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.161.224.81']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51ff6497-3fde-46bc-9017-994c6b5bf00f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.174.39.136']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--306fcf0f-fc71-48d3-bac8-80542e7c5f5e", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '124.29.214.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e86c03aa-dba0-471d-9586-be21b5bbb3a4", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '125.212.235.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0a41dcb-2083-44ae-b7a3-81c391d335d0", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '128.1.32.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85becc4c-bea9-4401-a53f-be0672045c77", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.103.53']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52a541fa-fe3c-43e7-bab0-eeb1acd7f7dc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.103.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10d43822-558e-4ad2-9170-66c2a2cf0d90", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.114.113']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a96e625-a0ff-4041-ba9d-e1b89313709a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.135.214']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02430407-4b34-4e58-926d-ca0dc4674252", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.121.74.52']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c6fdd56-7ddf-4971-befc-adccd0b4efd1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.151.27.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c4da14e-4e1b-4fce-a631-5f002bae6542", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.211.172.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9bb86e15-d98f-4759-a73e-9f01ce2cc29d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.224.215.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85057e5f-5edc-4c3c-819b-00b838339b6e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '129.28.47.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31d7d101-7e8b-4f45-bdaa-cfb4acdafb93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '13.70.110.189']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40bd5e29-e4a7-4bdb-93d6-57d213aa6fea", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.185.101.32']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e58a67c4-563f-43ec-8bdc-6e9eda38e54f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '130.211.240.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d3811f-a002-4558-ad57-2ce3aa507485", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.100.95.82']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--20b674b6-6ddf-48ad-84be-dd991cd9361f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '131.161.166.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f0d480a-f2f9-4bf0-8317-3cd2316392d9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '135.148.29.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c919347c-debe-4b98-b170-ee3e2e3547f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.158.57.148']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--00594102-c1e0-48d7-8639-1a803e79cb15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '136.71.90.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab, spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.86.168.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e82e1cdc-9c58-44a8-8e71-78eb74cb744c", "relationship_type": "indicates", "source_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4fcffe14-865b-4bd6-9956-4ba083a347f0", "relationship_type": "indicates", "source_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fff05ac5-5ea9-470e-b96d-99ef00d576fb", "relationship_type": "indicates", "source_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--30bf3685-43d4-4b39-9c7b-cf62086db180", "relationship_type": "indicates", "source_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--acca84b4-de30-4dda-910c-5a4a2b7d4fe0", "relationship_type": "indicates", "source_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb309903-1406-4299-9b87-3f8591800ffe", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '136.90.65.250']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61c7e698-0a99-4044-a4a2-14298a8e15d7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.0.174.216']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f778b41c-e157-4a64-9c69-534431a64a17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.117.15.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8483473-d079-4c31-b79a-5588eed28a86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.121.113.227']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ea39124-2697-4957-8906-d87138ca97c6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.185.156.245']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acfc7b92-d86b-4b9c-8da8-452cd3654800", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '138.197.171.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c003dc98-fb1b-4dfa-874f-f4e4a26ec9b0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.219.255.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f43d7178-1e90-49ac-9329-d57256bc84f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.252.187.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed361539-bcd3-4332-82bc-75ac1a6a6a3a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '138.68.63.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61a7055b-915f-46c8-a267-48818ce2a1bf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.100.16.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8da5aafd-df22-4912-80df-d354486333dd", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '139.135.40.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ebb35f3-9d68-4396-bb23-0cad236ef9a3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.107.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a9f8fda-406f-47da-b643-5b84ef6529e8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.108.102']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e6bcf085-54dc-453e-abc7-9ccfa941e80c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.103.114.85']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cfa1255-4c04-4fdd-be89-3c839e50637f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.161.40.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65f195ba-6a37-43ff-82f1-26fe7832007d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.173.204.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5817a2ee-c1fa-45ff-b011-d84d614054c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.183.72.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bc805f7-7fd1-4c97-a401-285e1e605366", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.239.239.147']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fad817b3-8440-4085-b79e-69bc6ee43a39", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '14.63.217.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9ce3ae-9e2d-45d0-ab94-54675bfc1130", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.197.143']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7d2abe8-25f5-42fe-9be4-e2674539471a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '142.93.80.248']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5aa6ad7-416c-4551-8d92-9b70da495277", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.198.44.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--342ce6e6-466e-4c96-98b0-cf2f08b15a42", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '143.246.197.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44964dff-ce79-4bb7-989b-a1d43127b11b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '144.76.68.198']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a6d3129-22ae-42dc-87fb-fe430fb31b1f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.174.176.229']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f28e64fc-be48-4bc4-b32b-615cf9fb2f06", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.19.78.185']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3bcccec1-db99-4176-b606-1e885063a293", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.194.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434ba2b0-c93b-4aaa-9d55-4b4e866876eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.70.199.252']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81a772d1-1268-4ae8-9a78-7c7f9cb9bed9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '146.88.241.20']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--678564d3-0ef1-4679-8278-4fe4cd24638c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66c0c1bc-f75b-4ee9-a506-b1028774c5e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b520d1d5-dba3-4867-9a8f-29b3bd759947", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09b803f2-9c37-4601-8474-9a91aedd70f5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6e88eaf-250b-43a6-b9df-4e4b567a490a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1603b87-f4df-482e-838d-2f482d30fc31", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.204']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f310315-6815-44de-a9bc-7095e27ddb8a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.231']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--855903c1-ac45-42e9-bdb6-239b9393730e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33fb3e0a-4c4a-4202-9d93-3fe761ed8a10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a87082c-447b-4599-8f4d-a05fa32c5174", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a45d3db-19ae-4152-a52b-596831b9c1e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50497531-fb82-4caa-9276-8821b9407fa7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07da86f9-6db5-4d37-b4b0-9dc4f8645233", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.185.132.93']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a89d43a3-3b85-425b-b27f-7a9cc5ead0a3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.78.180.186']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77f68f68-6d0e-46d3-b2f7-566f1f7fe5d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.78.180.247']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b100af8b-2d7b-4100-be16-f3e0e34e187c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '147.78.182.125']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e95041c-bfdc-4cfb-97f1-b42048a15029", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.109.6.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b40c548-42c2-4106-b81f-ea4b32754642", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '150.5.169.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3daaa307-31c3-400e-912d-20d2bfbe49ab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.242.30.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca634574-4bef-45c5-98af-64026f6f564c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.243.11.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79d957c8-eff6-4287-93ec-46b0fcf1655e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '151.59.154.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80e9c055-eb44-4160-8087-b82bcdc9ba27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.168.4.108']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--488c2cae-af15-4a8e-b9e8-477862157e36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.201.55.232']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a45bed6-e969-4785-a704-568262c6674c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '152.32.182.8']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f381559-4550-4524-8b82-443dddb49489", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.117.13.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c52d51a9-b98f-44df-82dd-b8324247896c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '153.67.7.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d72eb688-f5d5-4e19-95f6-06d233247be6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.221.20.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f08fca5-4c0a-4300-ae43-7606a2140da5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.27.136.212']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad672fbe-7a07-4445-a845-8e87af7a0b11", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.38.177.118']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--651c0072-2a5e-4569-821c-c4c6bf4aa439", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '154.59.56.63']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84f7ea4c-8c68-4662-8753-aa09df2a95e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '155.212.37.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c8e8ed7-b7cd-451e-bc78-2f0e0a1b5133", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.236.66.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e12ee5ac-9fc8-4721-846f-e23ddfbb8128", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.239.224.253']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d208aacc-6226-43a3-bdb1-ebea8e3bac2d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '156.239.224.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--968c5d19-657c-43ec-965d-c03b87ebfdee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.100.65.39']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3e2d12d-f92d-4cad-81fa-61300c7e3784", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.55.39.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cfcd0aa-03b5-490b-8fb5-a6a86dc9382d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '157.55.39.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b1fed0-7fff-4acf-b409-b76a92e6e1de", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '158.94.210.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bca20d22-8fe2-4011-9b0f-02b8c1202779", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '159.138.9.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e31702f0-bd21-47b4-94f8-5cc0282ad560", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '16.5.0.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c27fd64-b4cc-45d5-a9b2-205e4ecfe99d", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.217.103.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a842af2-3e15-49a4-8f4e-51d985ae995a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.121.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f57e6002-84de-4742-aced-5082032dcb42", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.213.165']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42a954d2-483c-495c-b25e-584d74bb9368", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '162.62.231.65']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8dc5ab5c-7717-4058-9d72-c0946fc182c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '163.7.9.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e85d371e-bc09-49d8-8da0-4f07ae6f1cdc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '164.90.142.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aff3ef0-a9e9-4c71-9965-8156627d4079", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.147.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbb85987-3a6b-4fef-95a8-715c1c5f224a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.202.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c370c95c-32bc-456d-9ace-7c97062cdead", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.154.254.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--980da5aa-578f-4d8b-a14d-904e13daec4a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.16.166.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2cbaee1-922a-4d9c-b707-bb9b0b90039e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '165.22.140.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b14640a1-d3bf-42d9-80e4-661cc921ed9c", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.250.202.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f547c1c7-68b7-45ac-a736-f34250a99583", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.11.247']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell, spring-boot-actuator. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.175.236']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--65a2e504-89aa-4c6b-8698-4ce05aab2f78", "relationship_type": "indicates", "source_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dabd24d4-de43-41fa-aa53-f861dba52b18", "relationship_type": "indicates", "source_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f915a1ba-5c27-4094-bd38-bd86e6a8e2da", "relationship_type": "indicates", "source_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "target_ref": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9b0ed716-dc78-4015-b4b7-0112cdb29b78", "relationship_type": "indicates", "source_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "target_ref": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--05506070-1691-432d-9807-8ce70c09e8c0", "relationship_type": "indicates", "source_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--126db277-ae8e-4d57-9e05-cd88a3571958", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.211.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7907d2-2e93-40cb-82d2-d25649def872", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '167.71.61.217']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1497d46-4c9d-428d-a68e-ef1fc557b4ef", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '168.107.89.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ec677c7-5f10-4e66-976b-05cebf96f874", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.144.173.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8910027a-696c-4eca-841e-730befd21f3e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.227.180.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d8f05da-397d-46da-801f-71db9939bda5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '168.90.192.240']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23907188-4730-49db-ab90-8d2709868490", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.166.23.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e5b4d2df-da0a-4827-99c2-73a24b5011ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '17.166.236.203']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0764500-6e49-465f-9698-1f6ef322ce27", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.113.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1393d870-c9e9-46d8-8e41-12a2563876e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.158.218']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67aca248-87a4-43d8-bfdc-728874be5f10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.174.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6224fc8b-c82a-43a6-8c5f-e1b3570906d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.175.140']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a7dae9f-17b5-40a4-9876-f995ea363361", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.176.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b8b321d-e484-4600-bf9a-d48d402311b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.106.203.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--657070b4-397d-4e98-b72b-705ba3b04bc9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.168.173.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b207f68-3b19-49ea-b00b-a545647e4957", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.239.73.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b7a0a69-bb6d-4e8e-ba1a-6db670509c7e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.245.118.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39c5677f-e948-44ff-8338-3c9314a1b913", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.245.173.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a54d8449-815c-4f7a-acce-4ba282af1f22", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '170.247.87.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5026e69d-6a37-40c3-99b7-08b62f912940", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.244.39.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27c2e316-47d0-486c-8b14-4a5c2c7ee4bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.251.237.250']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16766290-9bdf-4191-8034-650fa9ead2bd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '171.254.93.44']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff56e529-d5da-4840-a736-5104e8fd5208", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45dfc365-9d0f-4c1f-8011-2c9b4e8b2b47", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e306a9dc-84bf-4f38-a5e4-4b73d9bb76a6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.110.223.9']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5b040d5-2a93-4d38-903e-a7e8c3207573", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.121.183.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f18a88e8-39c7-4249-82bb-a7b5df11996e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.171.233.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--461930ea-ca9b-44cc-8c58-cc804b3f6a67", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.174.72.225']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acaf5527-9440-4202-aad5-d531c961f4fa", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '172.237.117.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63d53d55-99e1-4905-bd0a-4b30fa1b0277", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '173.239.213.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9752a97-540f-49cb-928e-bc592e4e9d51", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '174.176.72.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bce037d-59d7-43e5-934f-d756f28195c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.143.56.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fd7bfc-a441-4090-87eb-07556c4209ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.178.110.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa4534f5-f8bb-4b04-afbe-4528c2b0062a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.202.194.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--429717a7-ab7d-4ce6-ab12-fdf3d8fe03b1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '175.27.171.245']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551ac5b1-82ed-4c84-8007-bcde22f32d92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '176.41.33.163']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4bf3dcf0-605f-43b6-a700-385984a7a9c1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.10.203.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6599fd2c-8672-4fdc-b371-f316196adc84", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.130.85.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69a04413-5168-4a8d-8761-79014ee34172", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.171.40.124']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b517ff0e-c353-49ae-bddc-cac1546f57e7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.214.141.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8c91fce9-f20f-4b34-ab24-5004320f2cde", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.22.179.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--665d24cb-2198-4dce-b343-dad6f5f279b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.222.113.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3de14aba-6269-475e-b6a2-59117dd799ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.231.1.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b7950f-d0c7-47a7-9e0b-29f11d064dde", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.38.42.135']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98483eaa-8e3a-4d78-9a08-6c9a76664488", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.82.130.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c208b9c5-b612-42a0-a7d0-c27ed1f74e92", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.83.161.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b80a301-66aa-4c9e-8b50-26f7984fdcb8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '177.85.130.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf7bb648-e361-4186-a076-7b6b93a3a1c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.128.57.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58333ea5-c5b8-4e20-8fba-267448d1e2d0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.23.226.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd5219bb-6c87-43a8-806c-5dbdfdaa52b8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '178.76.241.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8819582a-62b7-442a-8590-67482709fe50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.42.153.225']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--524fb734-c971-4324-8ef9-1e9d47e16ced", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.43.153.10']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--988f5766-e8e0-4f60-b16f-9a29e2e8d45d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.48.40.213']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--185f4804-8670-49d8-a760-cf5fa63daa7c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.51.153.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--977db1a7-1767-46d9-9829-4ad45b37b4c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.6.29.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaed0d98-4bb3-4a14-a1ba-7f145d2eadcd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '179.63.33.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2998e7cf-bcb0-422b-a20a-753d7f74125d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '180.93.172.213']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31be4430-4984-4d0a-bdf2-da2cd311445d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.117.137.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--696f57e4-838b-4129-8500-a467cb53b265", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.123.245.116']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50fc2034-1428-45c5-9391-904634e7c3cc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.134.224.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--406da5ba-6cf2-42b3-aea6-5d722e100e55", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.198.40.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f5e81d4-ab76-4f8b-ad3f-b58fe27c4dd3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.21.174.118']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d7cff78-6331-46da-9d46-c5ff833570cf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.214.147.38']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2540a95-5917-491f-9e1f-55ddc3b79f14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.220.168.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b46d2760-ff59-4687-b364-bc112ff6e1ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.228.236.196']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21acc475-f47d-43b6-bc43-2dccf7abebeb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.232.225.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27d5de8d-5fc7-4b3e-9647-0518359db66a", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.233.61.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67fb807f-0acf-40dc-a411-c38fef14330c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.237.223.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0960fd7d-2d52-4915-8d1b-d7f72c6ef12b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.26.161.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--83334a29-9bb5-4089-8d19-48ebd5121e6c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.44.184.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--937933c8-9e48-46f7-b721-16be3e87c255", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.52.15.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e57a054b-37b5-456f-aa6a-7c96e6171c90", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '181.78.114.219']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94a6fee9-7497-4b15-b5b5-7158c43d06cc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '182.70.255.242']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b19fb5a-4a85-466c-9be5-efcd4033a53e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.201.208.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2d16407-4d01-47a9-909e-d29b4297b1fa", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '183.96.175.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50871110-4dfe-4ec0-8691-52949440cf9e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.119.212.225']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "name": "Malicious Host", "description": "Web exploits: apache-solr-admin, aws-credentials, spring-boot-actuator. CVEs: CVE-2002-1149, CVE-2019-0193. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0193", "external_id": "CVE-2019-0193"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--93b87449-62e2-4cdd-b6af-a96bdfe2c721", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d255a2c-0208-43cf-93d2-2fc10b650a1b", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6990e2ac-62f5-4d2f-bcf1-1c18131ce852", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b74761a-3bb1-4a76-b316-dfd60f75c2dc", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bb385d88-1b9f-4e5a-9700-2e91f5e9cde9", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "vulnerability--df0714f3-8905-4b38-81ab-0ec5476291c1", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9e44fada-8530-477f-8a86-a534994e438d", "relationship_type": "indicates", "source_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--826b6d4b-e331-4a04-b2d3-8de03c432133", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.177.72.81']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b6e01fbe-691c-46b3-aff4-88c728dea23a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.178.161.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09db3873-8b5e-4bf8-995e-395aebd4173f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.1']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4471c899-bda7-4693-9e70-40fa6b469bc1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.10']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aff245e-8fd0-4c5e-99c7-14e6ef9d4907", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.11']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--009a3e03-1cf9-4c5f-a3f2-73c3b5005a95", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5e626783-2bf5-4f7f-a7e9-351ceff76437", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.13']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73d66a66-0e83-4a5c-95cd-2ebd4c04a896", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fe1f7ee-3b05-4b87-b25e-723e33544969", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7b9070c-500f-4c76-9eb2-c8474a5cf8ad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--38f5816f-e79d-4ada-8f39-9f756c640a14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.17']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2e8f212-7ab4-4579-a18a-1ee7d83effad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70173015-c7b6-4470-9ede-5b712aad4bd5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d07bf895-4245-448d-a4cb-f985d188e694", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f7dabed-c1fa-4dd4-82a1-b4cdb629a69b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f727f23-1c17-4c5c-817b-83f66a15025c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.4']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7590c99e-f834-4dd1-8c83-889eb9b0ca41", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5c39fd2-ea23-48a3-a4ef-2a650f951f58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c206e6c7-86a2-4f4b-872c-6970aed8c8f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94b7bfa6-3c30-414f-9fa2-f2ab64eb7a61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.8']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84172eb3-7913-40cc-8e32-61d1467bbaa3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.191.171.9']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cacdeee8-d757-4de9-97f9-99899a8b71be", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.226.196.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18b54e55-ce1c-405d-9b63-4e255521a0d1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.240.215.110']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eb59dde-a398-4fc9-b57c-6cd81e760095", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.61.218.186']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ad77923-a3d7-4ecb-bc49-cbeb347dddb5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.61.220.31']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cbe66b7-7e6d-4fc9-84f8-2e2b1215cb87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.61.222.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3ae951c-2274-4f32-90ed-df19d9582074", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.61.223.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a66913cf-8ba8-43af-9527-db8f1fcc1e69", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.68.153.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db472915-08de-4159-8756-64b9bc86b3f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '185.68.155.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d080449-e633-427d-b18a-18219cfad53b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.121.105.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b5e2316-addf-4a9f-b672-309337f495c8", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.122.177.140']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43e9f214-33f9-4262-985a-16dc92031e35", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.131.184.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--732de872-10ef-4140-abe3-3c16ab1a9d86", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.155.18.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90666c3b-b049-41e0-9063-13cb4b45e1f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.192.97.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90883b61-e84c-4679-900e-3a2efbb84c13", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.216.180.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2ceedd6d-1a46-4e71-b685-4584e2c9656c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.216.254.83']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--529157ff-30ad-4626-9d44-f2bdef1f68b5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.104']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd43d4fa-df59-4fdc-ac11-f6921d80861b", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.68.83.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d515786-7b9d-4244-b62f-ceb5c5b71209", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '186.84.88.52']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae59f34-df85-4ec2-9194-e0ae2d5d5010", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.183.32.235']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d55ba044-eec5-4e30-8c2a-25ce68ec92e6", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.189.64.110']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d69818ef-99e5-487b-9230-98ae0a0d3cd5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.190.224.163']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5810bc9-3269-4793-b43b-ec34efa48c37", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.62.115.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d7ccd44-4d65-4a35-b6af-3ce05371e626", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.62.234.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--812c7ad6-b3ae-4183-a50d-bc71c02fc478", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '187.84.69.202']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82ac118e-95f1-436c-aa0a-bba96ef03e2d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.130.157.211']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7285a19c-36ba-4b46-871d-1d1524492324", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.189.203']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2a1be4b-3bbf-4e00-b4d0-a6bff8f3b4c5", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.166.223.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04cebaf5-4dc4-4b7d-b3ae-6ef73ae14dcb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '188.254.126.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6295cec-ff0f-470c-9915-a73150b86651", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.137.22.250']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18f9475f-3b99-4f60-9683-05747b86d9a9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.217.18.49']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9211f655-9e53-41cf-9eef-5c65a38fcade", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.217.195.63']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17c4c75f-594c-42aa-b292-753855fe909e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.219.191.184']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47c128fb-8c51-47b7-aee3-cd99373712f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.223.87.29']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b257449f-281f-49df-8491-aa8ec891ff98", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.28.76.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c65342ac-3d67-47ab-836f-9c36ce41c150", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.36.215.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daa83822-5d9f-45f6-a800-c46993ba0b6d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '189.37.75.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baa4f134-729d-4a23-ae16-3a2ff1f12c46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.100.134.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a044fa2-3443-485f-a7c3-229bb713b51b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.100.44.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5715452-ad8c-4f29-aef6-6f4fcfbee152", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.110.171.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fa8fd05-7e6f-4b56-ac4a-4334ff223008", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.113.103.185']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1af725e-aab7-4e43-82b3-a76527c75a6b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.114.39.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f56d2c13-7abb-4187-9053-7dcddd11c6f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.129.100.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b06a0f2e-d7ef-4cd9-a48b-eb4cd8af675d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.144.41.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--084aed92-5f3a-4639-9e31-6d0c2d69eddf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.183.214.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68666e48-247b-4237-b497-b0990729fdc2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.2.149.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c52b430b-d4dc-46bf-b43f-d707634d380f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '190.234.31.237']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c634b3fb-a50a-481f-8068-6d22f80e3dc7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.104.116.125']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26917cd4-3623-43fb-9562-e7947f2c3e67", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.242.39.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2dc0afcc-f2c3-49fb-a046-824c6e64cd3c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.5.119.107']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8066290f-e85a-4631-8618-e40a55ceb898", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.95.165.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b48fa6bd-4829-419b-81a4-83c000fd6f93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '191.99.24.127']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7baddb64-f99f-4d3b-94c7-384e2f869d40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.116.63.0']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d4d94bd-7104-4019-b258-720dbd429a37", "name": "Malicious Host", "description": "Web exploits: fake-googlebot. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '192.178.16.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7ec6fa4-9668-42d3-9f27-dd525775362e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.42']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--22648ae2-9a83-4940-8e8d-f513ddeb0d46", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '192.42.116.47']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f62320a2-8fa1-4823-9dab-041cd0f85a22", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.24.211.219']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--486d1c34-119b-43dd-b488-9695c94fba24", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.32.162.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a954dd9-ea60-490c-8055-96fc4c80b60f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.46.255.86']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c7aef50-9a34-4f3b-95ab-1613efd8e769", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.47.62.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--071edd58-75cd-41f2-9163-c4b389b6298a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.11']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--411dd63f-eb34-4472-8e35-01e3179c9984", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e4caeea-57e3-4520-83ff-0eaa5accb2a1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.13']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07931124-c727-43bf-a2cb-46ac892ff0db", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72d3ed44-ba41-4b81-a4d7-28fd8a9de533", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52ae2111-d7b8-47b8-a28e-3f18256de9fb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--116b8957-8768-4da4-93e4-89a562f56e99", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.4']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d1964c5-285b-4fed-a8db-37428283b54f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fdb5c11-190a-4090-aac4-61b0b4bc3f27", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08636220-29d3-46d1-8cdc-8f129a21f9e1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '193.8.187.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--425bd389-9061-443c-b5fb-1857a696e439", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.24.237.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04680b14-6454-46e7-b8d1-8c285e7b9313", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.28.60.83']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7207025-0835-466f-a7b8-2ff5c9a7dead", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '194.77.198.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d43ac9ac-8658-46d7-9a1e-5cd913e8bbee", "name": "Malicious Host", "description": "Web exploits: aws-credentials. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6f105968-9a56-407d-8d3c-0ee89338d437", "relationship_type": "indicates", "source_ref": "indicator--d43ac9ac-8658-46d7-9a1e-5cd913e8bbee", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bfc4f8d-a650-4eff-a238-ace121ad082a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cbf232a-ef37-43fa-8fc1-6caabce829d5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '195.178.110.228']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f89662-abba-4980-adf6-3875fe124622", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.207.227.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3dbb140f-4e80-4ded-9488-fd486f8e34f7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '196.238.13.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f106bc73-c37a-47db-b823-6048b37d9a14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cef7b58a-dfd3-4a02-91bd-78ece5db9c5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.104']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d951e32-ec8f-466d-9b8f-bcf245dfea0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.127']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c80ef41b-40e0-4902-99fd-5d037a9d6506", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.136']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d795f95-8470-4ee3-b037-3b0f35d1429d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.142']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a4a92c75-51ed-4a80-80de-34793c6467a0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d7ba19b6-69cb-4b90-97d1-71d1e8051739", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.147']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2a7e472-f78b-4d13-b493-b485e8b83a17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4cda637-6785-4451-b47e-18eee23a8bab", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.151']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21686ecf-29e5-49af-82e4-770e51b5d3f1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b316a8a-098f-4c88-bdd9-3ae5f2e30c8f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.155']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f290b38c-a4a1-468f-b3fe-b3cd0acafa6a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbef1ea6-7d58-4b66-a7d6-acd2d5f9c241", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d59ba85b-26aa-4b58-8bdc-b4aed31d151c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.172']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--260f3a81-3084-4c5e-900b-bf1baf5d6711", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2134989-a2c0-4638-ae15-b9d3dd7057dc", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb889dde-d061-453c-9230-589eb7eccf32", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.184']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--843f3b95-5a63-4906-83bf-f147e673e299", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.186']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70ef770f-71ae-4638-b9fb-2c5b5c79f7d3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.196']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b7beb7e7-967c-4192-b07d-fd779e469d15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.197']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--799e3f38-b113-4861-a36b-73bd1167c9b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--093cad4d-df9c-477d-bdab-1677c797de15", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.206']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a0c0776-482b-44c8-94a0-6a61c9e27d2a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77c2f315-8e4d-428f-a10b-1854989536af", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.213']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--356ea295-78e8-4122-902c-8c66fe42346a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2ed4a39-3850-401c-a9bf-a2710f362045", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd812dd6-4483-4b7c-9207-bbcf16555f63", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--597c570e-edd8-4098-a995-2bd8c5098a14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--586404df-4765-45ff-a25f-ae2861650227", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.32']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7acc450d-c557-4d73-b7a6-1265f1726fb6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c6b98af-062b-4caf-ac3f-bd1218cd8d66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ec159ae-5007-4947-9dc3-969b103701f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.41']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84abb3e0-3cf2-42c5-a068-5cb98837ebeb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--80d12be7-4cc1-4aa1-aae0-298d123ec968", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b17668d8-aff5-4edc-867b-65cabbae1b50", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5845a0a-df54-4a3f-bfdf-39009d987cad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--398f011f-0f39-465d-bf73-9784b13cab12", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.52']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b485ebbf-45c4-4a03-bf46-b86e2e132dda", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fd0b9ce-d1bc-4bdf-9c96-bf704046b32a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0d726644-32c8-49aa-9217-52b57c9f1a45", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.60']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4021bbab-d2d7-45a2-9582-939555907662", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b28747a4-44db-43f0-937d-cdbf67419267", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a18f0585-dd3a-4fcc-9dfc-ab5f223fae59", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4e99b561-62ff-4029-a0b4-8a1e4656896d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--509e9433-e13c-4d39-a717-c2f9f97f5957", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.235.24.97']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75746bd1-2f1a-4e66-9f69-051b935110c9", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.244.200.163']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5672748c-27e7-4c95-bbf9-306e656ffdc1", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '198.98.62.211']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8308c08d-8aea-4c7e-81f9-b59a3c6e0721", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.165.159.49']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed4a92bb-eefe-4956-8d23-a52d72b67861", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '199.195.252.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d1f2cc5c-383e-40f1-9794-8bfa7dd161bb", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69aeca51-eef9-424f-bb40-cec720af70a9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.121.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--769678ee-b651-4e3e-b371-1c7f795891d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4ffbb29-f6c4-4c2e-bee5-197fce65bc7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b4fed2d-3980-403b-b03b-0e438be215cc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '2.57.122.238']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37cce0ba-1c56-4082-a93f-875648a37dff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.121.64.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b5deec-640b-4b28-804c-d38dd5eddfdc", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.160.86.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5bffb3c6-2ca7-47c5-9937-7137a513c1c1", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.196.208.116']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b4f76813-0723-4162-a504-4f304d7f8f1a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.204.146.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a8b9c1a-e3d2-4614-80a6-0aa1b18c36fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.213.164.192']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cdfb32f4-b237-412a-97f7-601f8b562f64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.214.144.216']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e2056ac4-4b3f-415c-8531-35f1233a41a4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '20.239.176.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7163f7fd-f22d-4956-9193-ec1ceffd87b5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.105.185.133']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f23633e-e88a-4838-8aa0-e72463470b99", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.114.97.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f8efa70-f499-4c1e-8c35-f082d49a95d6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.114.97.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84233355-a75d-4a98-9f63-3b6c91f86865", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.118.60.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ec1ca6bb-2dcb-4dc7-9c19-e158ef44ef62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.124.252.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--182d00fa-bd0b-4ae3-89a6-7250e84276b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.196.140.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--887d0429-a8e8-4fb8-9ff7-fd19517c7f94", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '200.215.248.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--369b3be1-37d1-4388-9cf8-d4b36417ce7f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.132.241.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ffc370c-b692-48a5-9156-079a1123b6cf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '201.16.238.49']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--686d8680-0ae2-4e79-8250-9f086c452311", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.164.207.192']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16e37d16-7a00-46b0-ab38-72b8cab00f60", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.165.26.170']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c0925c93-3f39-4301-b2d7-08e2252ef7d6", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '202.86.149.20']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50729ce8-8229-4031-a523-b2f9c87f8e25", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.128.6.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf99a4a-4385-459e-bbb1-b58b7c4a08e2", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.189.221.17']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--611c102d-8c93-41e7-a00f-25bc0ddd5d28", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '203.212.9.221']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd689873-a3cf-42ba-96fe-dd48cb4b874d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.185.115.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc1aecb-4463-437b-82ad-bc82d941654f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2776772-4046-4a91-a380-12654c82d09a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--721f2807-16e2-47a8-aa1f-44ba0d1ecb9d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.128']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0292e112-6915-45c7-bca9-efc4e1e6f182", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76afe323-30fa-4b90-b63d-420c73619d61", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fcbe4c9b-1ce6-4d76-bebc-1ef705bda4c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.145']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c5a942b8-9f5f-4656-92ce-a121353fa3aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19ec4e89-dda5-4f1a-a6ba-82a0e391d2e9", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aea54850-53fa-496d-b88d-28eb305ee753", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c534da93-c86d-47c6-be40-b7a260ff7e95", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ac88495-543c-4e90-984e-06e889f4fee9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a872e593-4d7c-4f80-9723-c5f077928cae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b358ac-211f-4f23-8419-e74e07db78c4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.17']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb865dda-b248-4820-98e3-98d7f816eb5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--534dc469-458f-4cd4-82a0-7ff9bab168df", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fb70dff-9da7-498e-9557-76d59e26d492", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.192']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2b073b0-4953-432b-b968-463b3cffde5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84254c35-f752-4ccc-bd8a-cec79b32290d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.197']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc23236d-72cd-4823-9343-f8ef6ff23960", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--386d3a72-ccb2-4752-bd4d-2fae4438f094", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90690d02-8703-4ddc-a517-72dc60c312fb", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.220']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fbd6489-d5e5-466b-9a54-97ca12b33203", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1db6f4bd-1c21-46f4-829c-45a0f75a6b21", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.231']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac856420-c77f-417e-a708-231727353737", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.240']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0bd9736-7e6c-42b4-b32a-bb28cc4790d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.242']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fe0402eb-1ab8-423e-b9fa-7f25d22f50b8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.253']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aeea3051-7011-4706-80cb-7da1fe18f08e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50d2f585-3842-4d32-8168-5aad96b0a41a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.39']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0a776d36-c4bb-49c0-a277-6b37ff61f07d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.45']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--288b3009-73a7-4424-aee8-b823e182502b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.47']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19ff8dff-b856-44e3-9f00-356ed948c2d2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--190c9398-9d2b-4aee-88bd-c8124bb2471e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eab291df-4b24-4ecc-8481-2ce4528e5651", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b023cb6-5182-436c-927e-e94e7f2ebe14", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--65bfa71d-ea89-444b-9bf5-c85cfdee08e8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0dd068c-352a-4dc4-9fc8-09019fdec073", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e56f49d-5ce2-497a-ad14-876c59b13764", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bba406e-5d4f-446e-9cad-c43898f5ac17", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f684d946-3f19-42c6-b85d-a3c5d570ffa1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e545845e-48c0-4ef7-ba6f-11d5a687efd4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3832eef4-ec55-46a5-9047-987f7a82a757", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.93']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ae1d8f1a-880c-4fac-aaac-d31393f808e1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '205.210.31.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell, spring-boot-actuator. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '206.189.19.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--332012ee-39d2-4716-8911-68f9a187ca70", "relationship_type": "indicates", "source_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--19578386-3ea1-4eb5-99bf-057947a513ed", "relationship_type": "indicates", "source_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--df4bdd76-5094-40c3-90e7-10ecbdf2bd98", "relationship_type": "indicates", "source_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "target_ref": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2a43ee18-2180-4930-9bef-aabc9f44516d", "relationship_type": "indicates", "source_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "target_ref": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--152c73c1-0fa3-4350-bb45-5c8feab9dcee", "relationship_type": "indicates", "source_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73c2b156-2f29-46ff-b63f-99fc5b27d11d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '206.232.2.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b06db96d-da92-457e-aed4-f9bb29fbd266", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.175.12.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d072745a-8fe2-43b2-ae26-31b10babaac6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--023cf868-8a47-474c-9c02-257fa783f2b8", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '207.90.244.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1c309ffa-6241-4809-8bb5-d6417cf28ed4", "name": "Malicious Host", "description": "Web exploits: mitre-t1190. CVEs: CVE-2002-0953. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '208.77.22.212']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0cdf84f7-6fc9-4ae6-928f-5abf4759f573", "relationship_type": "indicates", "source_ref": "indicator--1c309ffa-6241-4809-8bb5-d6417cf28ed4", "target_ref": "vulnerability--651e8076-98c7-440a-b8fc-79814d7f4cff", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a358c003-6737-477a-8e53-896618597747", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.69.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--21edc03e-54da-499f-96dc-21b93338ac0c", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '209.38.70.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaa2944c-1caa-4e2d-852f-e7ba5ac30cf1", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '211.43.96.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--db9a610d-b6e0-46aa-a73b-fcaff56870bf", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '212.154.234.9']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1254d587-f0ae-430b-844b-4b2c95b7acdf", "name": "Malicious Host", "description": "Web exploits: mitre-t1190. CVEs: CVE-2002-0953. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.152.187.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0953", "external_id": "CVE-2002-0953"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aca25829-bc56-46fb-b377-b4196b7fb1e4", "relationship_type": "indicates", "source_ref": "indicator--1254d587-f0ae-430b-844b-4b2c95b7acdf", "target_ref": "vulnerability--651e8076-98c7-440a-b8fc-79814d7f4cff", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "name": "Malicious Host", "description": "Web exploits: spring-boot-actuator. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.133']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e034dfbc-00a1-4ba4-ab90-d70b3933d4fc", "relationship_type": "indicates", "source_ref": "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0ad2a583-a9ad-408a-b46e-96959a29eb31", "relationship_type": "indicates", "source_ref": "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--32eca5d6-5c11-486e-8935-6fb3e1067300", "relationship_type": "indicates", "source_ref": "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c123d669-042c-4936-81df-4e14a128365d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '213.209.159.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4766fd9-41c7-490d-a72d-55235eda3958", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.244.66.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07f0c669-316a-4aa1-bb00-b95768811d93", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.26.233.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--50b9f4be-7302-45fc-a14f-642978bf2027", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.26.239.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4c2704c-54de-4fee-a409-646140535e81", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.160.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f1d1544-c2b3-43cb-89d4-a6b1d5b731e3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.216.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93ed3ef4-9226-44db-b876-63dbe2eb7894", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '216.73.217.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59b929b7-d2d1-4f05-90ce-b71c663a8237", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '217.218.10.44']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13ee6305-168f-4aec-b3a7-d1d933f064b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '218.51.148.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e40fecd-9f8c-4d22-bc74-fc5f88e00928", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.180.119.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87ad1cbb-5227-4d04-96a7-e74702212566", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6617dac-1c4c-4cab-9f1a-715ea5068718", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f97f9e7-8042-431b-a0a9-f8de063692f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.181.108.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--890d14e0-8d32-45cb-9c9d-b332a8e5e671", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '220.190.91.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6cc706c8-5ca6-4fdf-9110-c899a50a1566", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.133.26.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2673a2b3-578c-4a6d-8e04-af696ecaef37", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '221.203.238.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4476c976-8b74-4b2f-a801-ca3a28af9f9c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '222.118.59.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--740ad783-fec4-42c5-a8b8-d9189cd26acc", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '23.180.120.171']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b37c6376-6ca6-479f-93dd-c15f786f5086", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.147.191.226']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0637a308-7a0c-4e4c-9bb7-279883a9fc95", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.34.67.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ebde14a-dadb-4d42-b6df-db056dee9979", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.44.125.38']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bed0d7b-b04f-4d12-8af6-b563a0f5d5f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '27.44.125.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7e7faf2-7a14-4caf-883f-7ebfd1b7918e", "name": "Malicious Host", "description": "Web exploits: php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '2a06:98c0:3600::103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a06cc7f2-4969-471c-8f0f-d25810a584a1", "relationship_type": "indicates", "source_ref": "indicator--e7e7faf2-7a14-4caf-883f-7ebfd1b7918e", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f6ae40f3-521d-48a8-8f25-4c1b9e0bd170", "relationship_type": "indicates", "source_ref": "indicator--e7e7faf2-7a14-4caf-883f-7ebfd1b7918e", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b78d273e-ff4a-4814-8109-d5dc39149a45", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.232.69.254']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--360827d9-a1bc-496f-824c-2343004ad3ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '3.250.148.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d5771fc-44f4-4c0a-8517-5c3cc310e48e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.135.226.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42adb5ea-7539-4dc5-bad3-3c987e30a8ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.162.88.239']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dd9ec39a-a67d-4490-b37a-95006d1df557", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '31.215.225.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.106.33.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ff29cf4c-995e-44e4-bf1e-6dc9702f2782", "relationship_type": "indicates", "source_ref": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--917593c7-7455-42e1-ad1d-4d8e6336c842", "relationship_type": "indicates", "source_ref": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d66f2bbe-736b-4187-8abb-082135e56f62", "relationship_type": "indicates", "source_ref": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "target_ref": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--2d1ff4b7-0902-4618-a253-bb604cd916ec", "relationship_type": "indicates", "source_ref": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "target_ref": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--178cf3f6-6e42-4501-b526-7cfa46ae310c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.121.62.221']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1655882c-868f-4943-83bd-7372752e7288", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.140.234.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--4860c08d-1503-4688-8150-e181b439cf89", "relationship_type": "indicates", "source_ref": "indicator--1655882c-868f-4943-83bd-7372752e7288", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7e4c13f5-45cf-487d-820d-2f458b1c89d4", "relationship_type": "indicates", "source_ref": "indicator--1655882c-868f-4943-83bd-7372752e7288", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58541032-4959-476d-b82c-38ee0faf3025", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.22.151']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ba9a1048-8e32-4e94-9792-648683a62fed", "relationship_type": "indicates", "source_ref": "indicator--58541032-4959-476d-b82c-38ee0faf3025", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cae963ed-084a-4e2e-b7fc-0eb194bf45c8", "relationship_type": "indicates", "source_ref": "indicator--58541032-4959-476d-b82c-38ee0faf3025", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf1e979a-12f6-4608-8e3c-a976cc081d4a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.156.64.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbfb3ffa-05f3-42b0-b94a-cadff01a7af5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.168.137.0']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--547bcc62-920b-4e28-afcd-69b33f0a244a", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.31.191.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.39.255.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8b8999b1-2a9b-4b97-b76c-3fa3a3f3bce9", "relationship_type": "indicates", "source_ref": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--47e225e2-772f-43ac-badb-97c845e503f3", "relationship_type": "indicates", "source_ref": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9ef2fa18-4c4b-40b8-8f9d-f705ff94f9ad", "relationship_type": "indicates", "source_ref": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "target_ref": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--12fbfabf-ff76-40a1-93ff-d35af1e7964a", "relationship_type": "indicates", "source_ref": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "target_ref": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.4.25.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9f220a89-148a-4140-ae67-9b04fdc1156d", "relationship_type": "indicates", "source_ref": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c5097379-dfa1-42e6-88a0-761ccb568072", "relationship_type": "indicates", "source_ref": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf724f4f-664e-402f-8d5f-4c8c29eec402", "relationship_type": "indicates", "source_ref": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "target_ref": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a08fc99e-080f-4076-bd8b-c629a170f75f", "relationship_type": "indicates", "source_ref": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "target_ref": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7515966b-06f2-4d81-8135-951e7889cd26", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.50.108.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ce0ffe1-1d9a-48a0-8554-ab23ef31b963", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.137.147']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8140110-e720-4eb1-9703-767b5f84d4d4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.52.150.124']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.62.25.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fa5c4ebf-971a-496a-8f40-f16ee138bac4", "relationship_type": "indicates", "source_ref": "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7d1a1a9a-85d3-4643-8980-cb08bd500ad5", "relationship_type": "indicates", "source_ref": "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ce6df222-08ef-4da4-8d84-44821c79e02b", "relationship_type": "indicates", "source_ref": "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7ceaff6e-7756-4f5f-a8f5-33a9b635a043", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.78.213.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7c26f52b-4098-45be-9fb2-83beee074afc", "relationship_type": "indicates", "source_ref": "indicator--7ceaff6e-7756-4f5f-a8f5-33a9b635a043", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c4bf31f1-0e7e-405b-9b04-336308c5ac51", "relationship_type": "indicates", "source_ref": "indicator--7ceaff6e-7756-4f5f-a8f5-33a9b635a043", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51be5e1c-9e84-4ab5-b2b1-7a04a1d5195e", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.86.46.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68f2ee9e-197c-43d3-afd1-7e542fd51033", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.86.92.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a5af7b0-1616-42b5-93b8-8afad06385c3", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.89.236.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--689c01dc-e656-4c85-8aa8-c4d49432382d", "relationship_type": "indicates", "source_ref": "indicator--8a5af7b0-1616-42b5-93b8-8afad06385c3", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23c91fbb-57b1-4a94-aa04-07263e9f2924", "relationship_type": "indicates", "source_ref": "indicator--8a5af7b0-1616-42b5-93b8-8afad06385c3", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8390727b-554a-4c1c-b951-5c1b7c0ffb35", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.90.247.220']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--20147d54-0dbe-4021-8c84-abf7851cb1b3", "relationship_type": "indicates", "source_ref": "indicator--8390727b-554a-4c1c-b951-5c1b7c0ffb35", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b7b1e67d-662b-4352-be74-ca706ad34a62", "relationship_type": "indicates", "source_ref": "indicator--8390727b-554a-4c1c-b951-5c1b7c0ffb35", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35aef63f-394e-4f69-8cb7-67cc9633fd43", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Sensors: openclawglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '34.95.191.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:openclawglobal", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '34.95.226.207']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6db303c8-2e32-438f-9803-30b5e493f807", "relationship_type": "indicates", "source_ref": "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--be48fe54-f931-46bf-81c5-8b54eb3f0b18", "relationship_type": "indicates", "source_ref": "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.203.244']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c1197df4-f2ea-45b6-9995-0419cbfd0b7f", "relationship_type": "indicates", "source_ref": "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dbd1a7af-e8dc-4bf8-ab9d-8d9128781cb1", "relationship_type": "indicates", "source_ref": "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f328fcd9-2521-4eae-af25-b0151bf41042", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.187.231.181']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d126d73-4a15-48f7-848e-36636b7ebf41", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.150.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5e6c6b8a-f963-47f3-851e-ed606f0b5842", "relationship_type": "indicates", "source_ref": "indicator--5d126d73-4a15-48f7-848e-36636b7ebf41", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e71d180c-eef7-4ce8-88c2-f82d48b50ff9", "relationship_type": "indicates", "source_ref": "indicator--5d126d73-4a15-48f7-848e-36636b7ebf41", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c17d68ff-d5ad-4340-9d28-21f8ab8d0d6a", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.189.196.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f25d7a40-a7ab-49be-a40b-79ef1e6b2d13", "relationship_type": "indicates", "source_ref": "indicator--c17d68ff-d5ad-4340-9d28-21f8ab8d0d6a", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--68da206b-3cac-4b9f-a081-d209b6fda306", "relationship_type": "indicates", "source_ref": "indicator--c17d68ff-d5ad-4340-9d28-21f8ab8d0d6a", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "name": "Malicious Host", "description": "Observed: OPENCLAW activity. Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2019-5418. Sensors: openclawglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.197.15.233']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:openclawglobal", "sensor:revproxy", "protocol:openclaw"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9c66e7bd-920f-4af2-a8aa-ced872de6ad9", "relationship_type": "indicates", "source_ref": "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d8ee335-5da5-4ed8-8262-878581161065", "relationship_type": "indicates", "source_ref": "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1b5593f-ae26-4a03-a4c6-1138f67981a7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.199.178.35']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2770602-8163-4d16-a16d-f120200af410", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.205.164.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1621d255-01b4-4098-8527-6bbbec9c424a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.210.185.199']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.213.56.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f269bc17-599f-433a-8a20-f994f3b452a7", "relationship_type": "indicates", "source_ref": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--3beab13c-1c64-47c2-b22c-59835582c1bf", "relationship_type": "indicates", "source_ref": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8607ba31-d569-4591-88d6-cf76c3a8559c", "relationship_type": "indicates", "source_ref": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "target_ref": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--f1a3da37-e878-4649-bb3c-aff5cff88957", "relationship_type": "indicates", "source_ref": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "target_ref": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "name": "Malicious Host", "description": "Web exploits: mitre-t1190, php-backup-grab. CVEs: CVE-2002-1149, CVE-2022-22274, CVE-2023-0656. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.213.7.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22274", "external_id": "CVE-2022-22274"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0656", "external_id": "CVE-2023-0656"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5ae1511e-98ce-46c5-8129-a21be2775618", "relationship_type": "indicates", "source_ref": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6aab624a-29cd-497e-9c07-b4aecd9fff84", "relationship_type": "indicates", "source_ref": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--cf87f806-e492-42ad-8505-d3c6a77b3e3f", "relationship_type": "indicates", "source_ref": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "target_ref": "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b5cf7bbb-5ebf-4f0b-936f-30a97c5a2255", "relationship_type": "indicates", "source_ref": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "target_ref": "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46b6ef10-b478-4ee7-ac64-e97a504189d5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.215.243.27']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f5db75-b1a3-4542-804a-aa51c6bd0a0d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.216.253.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6af2ac07-2f48-43dc-8ecd-cf70d0892789", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '35.233.99.27']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--0d46f7d4-7f24-492f-8c5c-529636dc4031", "relationship_type": "indicates", "source_ref": "indicator--6af2ac07-2f48-43dc-8ecd-cf70d0892789", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--25890efb-76c3-44d0-94af-6c491f81e732", "relationship_type": "indicates", "source_ref": "indicator--6af2ac07-2f48-43dc-8ecd-cf70d0892789", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d22484c-e0dd-4545-9507-45a4009810a7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.237.94.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66f202be-f2e8-40d4-be62-08c588d3e6fc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.245.28.208']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7599deaa-d422-4c05-8c5a-fbf676596630", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '35.254.78.183']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58db17c1-c2cc-4491-8da5-0098e6f44e09", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.50.177.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da3d9de0-86a4-4a39-aac0-f5c913fac09f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '36.94.25.170']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fdfe5627-d400-4717-b17f-61590d22446f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.111.225.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--080bd13f-da31-439c-b556-5ca730c131e5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.114.177.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9fa9e78-22e8-465d-8bc9-51f6127aea0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.130.68.247']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25894873-71b3-47b3-8547-8aa1e6a9f78f", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.187.35.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--507e18a0-2161-4b86-b2ff-eeacf3dcb535", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.32.73.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73271101-dd9a-4852-9334-c0c1404efc73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.40.225.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--99faea7d-4f14-49cb-8036-9af0cfa45758", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '37.67.119.102']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e658ed1c-7ab2-4e15-a55a-93318f30b5ec", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.183.115.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4d96f60-45d2-4d08-9f35-1a9376954402", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.188.233.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--939dea73-b6fc-4574-9ba5-209905d5d593", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.191.38.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b414e38-c903-45d4-9976-514a49493bbc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.210.252.4']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--23eddfd7-1fdc-44d3-9661-7f14002bf0f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.224.228.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2597b68d-8a46-4ea1-8798-3e1b78a6efa3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.225.32.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e0dbb32-219b-4990-9d4d-8a853f7dca34", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.236.11.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--430e8804-5138-47a4-b509-8bc5bb3103fb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.41.42.142']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf6a1660-36fd-42d7-b705-01b0a804cb09", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '38.51.39.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bacab76e-ced3-48ff-b68c-22aa6a5bb461", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '39.120.34.60']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8cef6713-ad93-4ddc-8094-4d183b231368", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '4.224.122.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54079409-30ba-420c-b985-b8d871e97459", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '40.119.40.27']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bf8674e8-00af-43e1-a772-bb18fce3000f", "relationship_type": "indicates", "source_ref": "indicator--54079409-30ba-420c-b985-b8d871e97459", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--948cc627-5f28-4a31-ba2f-bf84b8594ca3", "relationship_type": "indicates", "source_ref": "indicator--54079409-30ba-420c-b985-b8d871e97459", "target_ref": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--23788369-a156-4a56-a68f-940dbc772190", "relationship_type": "indicates", "source_ref": "indicator--54079409-30ba-420c-b985-b8d871e97459", "target_ref": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b594dbd-5924-4be6-92f4-7a99621b4457", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.74.210.66']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94d2af3c-c514-40ce-9dbd-85b83bb0f29c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.74.77.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e553dd73-7d84-4237-9481-1afaa47babfc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '40.83.95.41']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edfff737-6756-404d-9bd9-bf1e963c8ece", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.142.220.199']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--229559f2-926f-451d-98b0-5f0fac7372b9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.181.156.205']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--992d74d9-d361-42e9-9fbf-d0d8b2cd8447", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.208.141.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07b93556-87a2-43a3-ad92-e22996903482", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '41.214.76.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ac21299b-0066-4e86-88e9-086ac7e102ef", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.149.102']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--52cec7dd-2bcb-491e-bbef-2b6b019ee711", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.128.228.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--028ed57b-6e04-431f-98b1-cd338eb1d2b2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.110.203']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b2dec90-e9c6-4370-b252-30b684fd82f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.12.229']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d61f7ed0-f2ad-4ee2-97d8-8efa4cddc161", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.139.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba3efea5-59d0-4038-b7fa-eff25eba7f5a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.146.123']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12611314-e67f-4642-a163-3b8c3b88fea1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.174.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--91a1ba40-605c-4c3d-97b7-2bcff97b7f1e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.32.245']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ea17cd0-e29c-4653-94e9-ec46b6fcdd58", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.67.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--89b30f12-ee4f-4a2f-b37e-18222a4807ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.73.116']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2ba8caf-a856-42dd-a8da-1d2772065dae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.73.221']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9465d33-3788-4d90-8c23-b34a8baeed7d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.130.78.183']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d87eb18d-d8e7-4982-9244-c90a352fef0f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.131.6.212']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cb2aab6-e614-4b7a-bd8d-2dbc0716395e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.174.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca15f936-08ed-4042-85dc-31c6027099b4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.225.186']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eea79de1-a916-4e2f-ba57-2ad0e67f0b07", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.132.229.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35c937cf-3120-429e-9238-9b1d59be9a36", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.10.184']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--55a50086-7f7e-4511-a7ad-2b3147b4d7fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.13.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--71322c50-437c-415f-8ead-7121034099ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.185.108']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b04be37-6616-4cc2-a036-a0c1220645dc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.191.206']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f953998d-4037-49ef-a5db-a2fe2ef45840", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.253.253']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b9a2b79e-8be8-4212-b58d-d4798eb2f0bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.133.40.212']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28530011-4878-404a-9883-20fbf853d86e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.191.34']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27f8f444-6315-44ea-9796-f72aa4311dbd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.232.227']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6a15ace-0a1e-42aa-8e49-9194997ed9ea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.235.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--917db6f2-7587-40b1-94bf-cc17dfbb7879", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.238.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37681ad3-b2c8-42f8-9cff-d50172977295", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.134.40.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31218200-17ec-4dec-aaa8-6a8a5ca301c2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.186.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b1a3295a-6170-4d41-971e-97489fbb6390", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.135.93.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4370080f-6ef4-420f-ad8e-3d8484c87b96", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.136.119.249']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--14e72ebd-2e3b-42ec-b6f2-7ec980dc95a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.0.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d3fdcd5-7ed5-4b73-846a-107d6c19b7b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.100.191']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b155054-4c8b-4d13-aeb6-0ae3de157dfa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.149.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aa974e0-4539-4206-915d-b1c2c5882d88", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.152.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48a281ec-54c7-4aef-890a-7776fb8a293d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.20.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b248cec5-d624-45a6-89aa-2610f4e242ee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.23.35']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--236d1810-aff9-4bae-b862-d5ce724d34f3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.26.238']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56e2fa01-7c80-4ff1-9aab-77c55c8caafc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.153.70.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c84cba95-d27b-437e-b128-68dbf6b05291", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.154.140.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95f7f48d-93bd-43bc-ac6c-9bfba0050bba", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.195.141']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ca067eed-77bc-4243-af1c-43ac1b9ca282", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.155.4.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0cb6207-9060-4a26-8098-d3921d661a28", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.133.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87a8ff61-26eb-4747-8809-8d57784e773d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.22.167']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f37370a-6caf-4597-a5ef-61fcb3ab8682", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.59.123']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37e45eac-5bcc-4c19-a656-e7a6e6e8e346", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.63.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a0cb2d30-7883-4090-915a-051db9042018", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.156.79.172']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f50896f1-5b42-41dc-865d-1f1382dd34cf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.119.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--33031f4d-e04b-4d01-9744-a3320174a86d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.122.146']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--690a3ef6-6364-47d9-ac25-72d36cc1645f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.49.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a6f3b4aa-3bfb-4eeb-9baf-fb60b1ab4d62", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.52.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63609137-0cd4-4361-b3a6-46c1a033658d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.67.226']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d55d6c88-e60e-4e1e-a35f-56d1b982e546", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.157.72.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--514cb398-87af-4184-94ce-0090511bd2cb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.198.130']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d81529d-833a-4ecc-b698-c81b9b4d6823", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.159.201.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47e86290-f061-47bc-bc26-8c8d8e2e4cde", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.162.114.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a7efcc7c-ef61-4a4a-90c5-87d27509ae5c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.107.198']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d21ac42-a06c-49bc-abea-5f2ad8f3ab2e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.163.123.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d8e5659-a4bb-4002-b373-6ebc2ec9f761", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.190.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79f2766c-41b2-4e7d-8f1f-f65174819c82", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.164.3.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--133f0786-997d-48dd-95e3-f65859d22040", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.195.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcb94c6b-4e8a-4b05-8a69-8b1a94e608a2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.165.198.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--737d9344-5569-44ba-b2a9-8fe78df0529b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.130.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab46f395-4a11-4d9c-8519-fc6b26c5dcbb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.153.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a751d77d-9dfb-4f6b-ba57-944c8b5478e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.162.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17e13469-0c42-4394-8319-696cc10d4afa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.164.172']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5aa4745d-4fe4-4757-8b2d-b29a6f8d112a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.166.175.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e68311a0-1148-4f23-9fd4-51b19fbed38d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.160.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3fdc94c-1d96-4cb1-9692-9b4055212cc0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.163.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ed0c89-c5de-4380-9621-918b4a034d76", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.169.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daf417f3-6906-4acc-8f45-76a4d580dc33", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.167.241.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b3ef0d0-d63b-4105-bf78-96a78ed9f5af", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.123.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--669e9b08-a7ec-4a21-a27c-6ead5d2f562d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.126.157']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1f9d689-1d93-422a-84bd-fe1e9a2bb312", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.127.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3c571551-c1e7-4150-8333-ef38ad048f9f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.174.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--640ef0d7-5560-4f0b-9262-656bf37e3e1c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.176.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1ec0e0ee-3ec9-425f-91eb-090b4b79aadc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ae3f8f0-1592-4378-93f1-8760e9d143c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.179.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--275d67ad-8cd7-4b3e-a6f3-053e0473bf20", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--722f2940-21e6-4db7-b68a-7f597ffc90f0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.180.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5f9128f-4fac-4d89-b13f-897bee990cad", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '43.173.182.107']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76985ca8-6993-49fe-931e-90680cdfe1d7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.111.202.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c277dad-0744-4058-9c67-b3b309dfcbf5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.119.212.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--77893b9f-18ee-44ee-97ea-1cf629c90a35", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.123.110.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a201fde9-75f7-4355-85a4-b8f2e920bae4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.136.103.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c21ab2a5-0580-4bf2-a914-d27901a5c81b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54920611-99a2-4d38-a1c8-108b401f7812", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--d50074b0-8016-4fcb-a584-e72b520ae6e5", "relationship_type": "indicates", "source_ref": "indicator--54920611-99a2-4d38-a1c8-108b401f7812", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--189d2ef2-ee5b-4783-9693-2b2b3bb5a14d", "relationship_type": "indicates", "source_ref": "indicator--54920611-99a2-4d38-a1c8-108b401f7812", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6da7b7c6-cbec-444e-aeac-1196771fa6b6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.138.12.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--79606229-82e9-437a-bb61-87985a2c0e0c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.120']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a8ba71f-63c1-406f-8ea6-363168ae0f7d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.141']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dc86888d-3701-40ab-b706-1c80998e9d50", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.151']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ae09423-7b04-4016-9845-db5e2e401114", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9270ac86-7139-4e74-a20d-dd1a0b39ae38", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.157']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1d4ab304-1498-4e37-afe7-07f28337352b", "relationship_type": "indicates", "source_ref": "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--24d63fc1-2e30-4bf6-b549-cecf8bff4db0", "relationship_type": "indicates", "source_ref": "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b350c9fb-6f4e-4567-91f4-0cd8a3bb664b", "relationship_type": "indicates", "source_ref": "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfb749af-9169-4717-b73d-851a31b1542e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon, vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.240']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--067f4fdc-18ea-4014-8909-5cfddabb0b7a", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.148.10.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b53cea0-8d17-4f91-aa2f-8cd4837d7274", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.39']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a132513c-8f29-496f-8d2b-ce337aa1762c", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.153.34.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--55c15905-f1b4-4824-bf59-0556fa9c0323", "relationship_type": "indicates", "source_ref": "indicator--a132513c-8f29-496f-8d2b-ce337aa1762c", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--7a84c6d6-c248-499a-844c-589ebbf5fcf1", "relationship_type": "indicates", "source_ref": "indicator--a132513c-8f29-496f-8d2b-ce337aa1762c", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "name": "Malicious Host", "description": "Observed: WEB activity. Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149. Sensors: cfglobal, revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '45.156.87.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:cfglobal", "sensor:revproxy", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--945de56c-093c-4a49-8375-d08a4e955d48", "relationship_type": "indicates", "source_ref": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--c55b27b6-91c2-412a-bd7d-ed8d1bf73c2b", "relationship_type": "indicates", "source_ref": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--ae7e88f3-9bad-4e21-8c34-55a71a425c54", "relationship_type": "indicates", "source_ref": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4f577858-af3c-42c3-a574-bfe8d03fa5c8", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.157.112.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6328c1e-7fd8-434e-98e9-03d4b1117ddf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.160.191.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08ef5f04-a416-44c6-9ece-43cd350b8290", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.172.29.130']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d886b4dd-f066-43af-bbff-9615a4893829", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.198.224.251']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fbdfd4b9-ca06-4c92-8574-a487d847dca7", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.205.1.231']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd314075-b975-44ab-b8aa-25880b45fe52", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.217.228.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--95b2e6d9-e172-4cb0-a545-654cf5b9b7f2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.225.78.199']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f51a41d5-40c9-4ff7-8e2a-3c08165ec917", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.234.212.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ed1ebd0-50d2-4308-9203-febf0466f868", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.236.138.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0c302a3-7362-4bb5-8d43-855d8dc92c16", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.58.52.47']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45fdae37-0f7d-40e6-acaa-a88a8dc49174", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '45.70.29.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0341895b-9ffc-4894-b92e-ce17c8ac30d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.149.75.45']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57568164-d930-4c35-84d8-6ae1404f9fbf", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.16.228.205']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--27ad2392-2b33-4126-a529-8b772694e4fb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.191.189.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cb146f3-1584-477d-9932-b16d76fa8a53", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.200.237.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0541c04c-8ed6-4171-81df-0117b593f728", "name": "Malicious Host", "description": "Observed: MSSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.217.151.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mssql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--266fb56e-7df6-4c60-8348-b397d43ffc87", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.53.240.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a44fa219-f1b4-4fbf-8990-5683933cffae", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '46.61.124.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--31f4d846-fcf8-4c44-b60d-244d5c523cd2", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.128.62.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--042b2f03-12db-4187-bcbe-ab4864c6eda3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.236.228.211']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--002b9082-56ea-42a7-9c0f-bdaf55157463", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.239.86.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b3a1fbd-48db-4f81-a963-97ee605e88ec", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.251.93.165']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70d54ea5-29ba-4ad7-b9dd-4bf4ea70f68c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '47.76.152.128']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8db753ae-63cb-4a4d-b171-18322b315d44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.237.195']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0eebb53e-6dee-4608-877a-49616b2a9206", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.0.237.214']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252ccfc3-aa55-46c4-bb73-7ba2fc1d054e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.132.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7156c2be-4da6-47ca-8fef-2f8c65e498a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.51.233.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97873e9b-7862-424d-ae3d-8769901778c9", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '49.72.212.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81039d3a-0c1f-46b9-9dd6-b6f24fc5a310", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.133.192.138']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b5f3204-ac8d-4e4f-a4e1-8a709609c214", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.135.106.85']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b956ac5-8a31-41d0-8d0a-0dbacef6b6c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.145.231.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c584b4cc-dbed-48c8-ad53-eabae2fbb3c1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.31.208.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3fe49d19-0a7f-45bc-9474-c3ad2d698b3a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '5.38.33.36']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--36f0f619-4635-470e-b607-b50b0c99399f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '50.117.36.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3e9c5915-a008-4617-8ea2-1f3628523684", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.161.136.177']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8f3dfd7-ac6d-4143-9d5a-a88ce41146f9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.161.37.217']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f06d3086-8c5d-43e6-83fd-980511017f65", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.221.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bf1028a7-e9f3-4d94-abf3-d75b2e56336f", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.38.232.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25dca53d-3f64-42fb-964c-a93b95430034", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.8.102.242']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3005bd6-05e3-4f22-b8d6-4b715dd74803", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '51.81.105.24']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48a42d0d-359e-42c8-8088-c02c5d40ae2f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '52.167.144.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62301df2-896d-44d4-8df7-81f6279b2f44", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.163.157.195']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--298d9329-f335-4cd3-a27b-f6a87f7e102a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '54.194.120.215']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--84e721db-6674-4dbe-a925-eac8dd498758", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.131.131.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f5c2c4e-36ac-46c8-b5fd-308be74ed348", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.2.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f7ca3f6-b081-414a-a9e6-955919c2ea64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7bb023e-b929-47f9-bf0d-c6ce6f945320", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eaa10b93-2df3-4811-a548-22915e0ad350", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--848abc1c-9a12-496c-b23a-1ea6ac677bfc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b2e1a0f6-8077-4c1a-833b-c96700e979eb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--06e042b6-9537-4a2f-bb01-e4754be4c15a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.66']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef3ecf3f-e88e-437c-b290-f768b90c2811", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--737098ab-c0f8-4017-8d4b-f0ac486c2454", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '57.141.20.75']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d49f35e-d109-454d-b067-aed7acc8f083", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '59.153.112.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--040689d8-7161-4108-ba4e-b9c77255e7f4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '61.9.7.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d9ff791-02e3-4e6a-9528-976ba6090775", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.111']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0151dfd-22d8-4a58-9058-b568992b30a7", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8b86f239-2057-43c7-9c36-358b1c306e4e", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.242']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c14f678-3ab3-402b-940d-4356caba3608", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '62.60.130.253']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd336f74-a5a7-4722-9c50-13a229011958", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.64.167']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell, spring-boot-actuator. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '64.225.75.246']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--aa6064c0-8e15-4f53-a312-392b2e70092a", "relationship_type": "indicates", "source_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--35f4f850-f662-4062-97d8-09af50f9d8e8", "relationship_type": "indicates", "source_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a53b66e5-40f7-405c-8c3a-95f17b73e137", "relationship_type": "indicates", "source_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "target_ref": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5c92ab13-3622-474c-a960-d1b08bdcbe8d", "relationship_type": "indicates", "source_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "target_ref": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--192af310-8165-4298-85be-8b99849b8990", "relationship_type": "indicates", "source_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc6e4893-e162-4472-a812-798af1167ecf", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.159.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "name": "Malicious Host", "description": "Web exploits: exchange-ecp-proxyshell, spring-boot-actuator. CVEs: CVE-2021-26855. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '64.227.70.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}, {"kill_chain_name": "mitre-attack", "phase_name": "discovery"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26855", "external_id": "CVE-2021-26855"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34473", "external_id": "CVE-2021-34473"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22947", "external_id": "CVE-2022-22947"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--a694b2ea-af86-42cf-8854-b42025d01c3c", "relationship_type": "indicates", "source_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e1714aea-1cab-4f6f-853e-c026d5573ebc", "relationship_type": "indicates", "source_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "target_ref": "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--298b4f65-4aae-41b2-af8e-96ddad80cb66", "relationship_type": "indicates", "source_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "target_ref": "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--055c50ed-5289-437e-b0c6-fa7d9b4f9c53", "relationship_type": "indicates", "source_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "target_ref": "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--bd26e9d0-b856-4a6b-9782-820697cc5410", "relationship_type": "indicates", "source_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "target_ref": "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9d701e3-1ff2-451d-8356-29779b57f2ac", "name": "Malicious Host", "description": "Observed: MYSQL activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '64.89.163.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:mysql"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90c4ab79-bf2b-462c-abf7-073358089362", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '65.110.40.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2363fac1-38d9-4cde-87e7-06f339f72162", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.159.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b885d9e-d111-40f2-bef3-053bccaf73aa", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.132.195.191']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5d2dfd9b-a701-46ba-9fa8-f64dbebb3e49", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.66.164']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--629f4e66-791a-41c5-b012-af89628d47d1", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.66.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--451d82eb-7504-44d8-9904-6a379bec7f8f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.66.169']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--004bb35c-7187-479c-95dd-6d95179fa88f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.68.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d093e952-31ad-4166-8312-987f9980d204", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.78.35']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a4b26e8-0498-4379-beca-8f71b1904291", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.78.36']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa9e219c-91f1-4ecb-8783-b1e47ac78db0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '66.249.78.42']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6098a23d-11ec-4c57-9980-8788f2916c57", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.12.57.83']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13ce7d1b-b5f6-4f67-8590-c0ce65fa9719", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b5187dd2-aaa6-4c76-9a80-33a8cc27361a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.101']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cd5a3a5-12d5-4328-8cc3-6d11fc1f70d8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.102']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a76fa53-5b7c-443a-968d-54e20466c25d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1383927f-63b6-4ea1-9058-0451bf6f0bdd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.104']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c941e1b-1b59-4923-bfaf-6be6298c1635", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--817d3a55-2253-41c2-9a4a-7e8e945a0b43", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73de9e7d-eae5-46f5-9f26-6deb91e13b3c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.107']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5390da00-feee-4a42-8ec4-0c36eb0554f4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.108']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--341c66c1-b4dc-4cc2-b379-22906befd00d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ea921c2-8d73-4126-9b28-db7e5d996988", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.110']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a99b9010-396a-45d7-bc9b-aba0afbdd6f1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.111']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7151f304-e5bd-4efb-9c03-b4d551ee5746", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--696ede57-cf91-4800-bfa8-ed9e816bb110", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.113']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69374934-404b-4a6b-b31c-b5c1d80a9ea0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8b01c10-79df-4bb8-9537-073d2f55940e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86c7cec6-3213-4559-8343-8fa50edca54c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.116']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2f3d5dd0-de7e-4601-a10a-9b307623c304", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.117']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6f6063cd-7861-4f22-9e87-f4a950d55a34", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.118']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--01b604fd-2a26-444e-8121-0391576d822c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--443732ef-fa6d-4e08-9ce8-5a21a94829ce", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.120']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--776371af-4451-4bc6-9bf6-20b0d2c83a17", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b55d4017-bf2a-476b-8182-c20a632b6295", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.122']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a6674c3-489c-49dc-9069-656ce46efb1c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.123']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76f254f4-e6a3-4197-b9a6-9c693b329372", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.124']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--30631815-b3c7-48e0-8431-92c783b5d68f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.125']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--371d459a-3241-4d53-bf06-778e5eff043e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.126']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6ac9a356-11fe-4d3b-aae0-307e5389b059", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.127']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa7636e0-9f1a-4be9-970d-02ca0f2f1f0b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.128']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f681c5c2-0b99-439e-8f7e-505c41a02c33", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.129']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e52f60f1-16c7-43ad-a575-763d861025a4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.130']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7b3dd300-9bae-4b2c-b92e-112fd18ad6c8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ce4660b9-5065-4c4a-9ec0-49a8a83b5cde", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a5d16656-285e-4e2f-b6c8-4d85603494fd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.133']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a8023dc-0d33-4975-aa2c-910652793ae1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.134']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53b07310-7186-4f41-8f4a-7aeb7852b44a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.135']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4ad2477-5643-4112-beb9-d49b17eaf332", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.136']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a99f06-6566-41eb-9872-8eb1c054cb99", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.137']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f0637a3e-519c-407c-9e3a-d2b9fb10a273", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.138']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d1cf65e-c7af-4799-9cd7-bb536a2384ba", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7633080b-de13-46d0-9782-9bc06ac509f9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.140']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf2c2d6-8f13-4a9f-8804-43c66cfdc393", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.141']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--315059c5-d8be-4721-aca1-0afdae3008b7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.142']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c125c929-83dd-4e9d-9380-099ef7b2bfb3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.143']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b73954ca-72e3-412b-86a7-84b0e23d9c63", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ad5a4e0b-40c9-4706-9da3-d5b020eb8bf6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.145']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcfeee35-cdce-4b24-8be7-8bad97db4aab", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.146']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8677d34-a2db-43c6-b90e-c0cc31e535da", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.147']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e1a9a0-b19d-4863-9fb8-89ac2669d6b0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.148']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--10acf6c0-f83f-4d2b-9568-ea683cd4dc9e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f04b6d8c-92e5-4fa8-bada-79d869dd532c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5c96a6b9-732a-4f91-a8b4-ab9f95dae21c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.151']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ffb54b12-2910-4678-9e94-e7ebba2e198d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--252cc3eb-3a40-4b26-8bf9-4bb33d093995", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc973496-bed5-4930-b3de-a81d7ce9b4bb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eacff47-236b-4580-a374-e58e337cf108", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.155']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4141428-7280-4ded-a94e-f52e52ef2fc9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--513ab47b-8be6-431a-b53d-65d1334806d1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.157']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5acfc6ef-73d6-4ec3-8717-f3e325f487aa", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bbf39466-1b1e-4dbd-8362-c58d5242a53f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f54565-ab72-4795-9c68-2f44f5343832", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c510812e-1633-4f55-a4de-3613daf0e781", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--aa34af50-75a7-40d1-93c8-ee4eee713774", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9cfb976-a26b-4488-b67f-1a56a8c012bc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.163']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2ece4a0-592f-407d-814f-92c1e54c1481", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.164']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54e1cd3c-785a-4f79-92bd-5fb14b6d3d5a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.165']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--278a3f7f-0b5c-4283-8137-db049b38d26b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3d1777de-73a8-47c0-8918-466d78e27bd9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.167']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0ff02e1b-858c-4f89-acec-c8d4c28820e4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--39d6cd70-6cd3-484a-8592-cbc1df16a8c1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.169']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0761ab1f-804e-4737-bea0-c02706925a0e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.17']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed753517-65fb-4382-9750-6115aa24a12f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.170']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0fdfdae-b5d6-4548-9fec-d92fec311f07", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.171']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d27f2325-a7a1-4ca7-b92e-ed4c0962c35d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.172']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc47b3a1-912b-4936-ae7d-6003694b7bff", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--adf3671f-db70-4698-8f57-b8fb06eacbe1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.174']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a498593b-7b97-4d12-88aa-499f9a122ca4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.175']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3a68ead8-54eb-490e-a95d-91542cd0a304", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0f272ba4-3075-4ca2-b72c-9473953bab3b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.177']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51bc64bd-b0f3-4466-bd21-b43e8a022c72", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b645bc7-0674-4432-88b4-3ac2c121c465", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.179']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6e25f00a-e626-489d-ba78-26e53af752b9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b1402e7-3977-4db2-a599-a62d15b22668", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7cd2500-91cc-4d7f-899a-5b4bc7ee5350", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.181']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5f8bdaca-34e9-4331-b098-42a1f1c6ec91", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f680e1d1-1088-4bb8-8210-dbb3795971cd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.183']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--427885bb-7741-43da-ad12-3f3a6bbc05a4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.184']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b383604-0733-4c74-86c3-9b07ff3053a0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.185']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8764d6bf-06d7-4a85-bdf2-bee533187c12", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.186']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--091772d1-e3aa-44b8-9f06-52673ccbf0e7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.187']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a793d0be-e49c-44cb-b037-b467f2063dce", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--32268e56-fd7f-4a0f-b48a-a8193d6d0dad", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.189']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--59c36667-e898-4527-a230-52f034d00853", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9c022a-ec70-4ed7-9f8d-90c54747a8a1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.190']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc865eb8-d46b-46b6-b590-111788955c4a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.191']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2520fb85-4efc-4384-a0f4-90d9e64af0bb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.192']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--87bcbd7e-0f60-446d-ae8d-a1598973b122", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a2f61f5d-270c-4bde-b17a-a045845a6428", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08bf1466-8e62-400d-b62f-3aac88277aa0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.195']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08859bce-b286-44a4-a4ff-bdf611b57f70", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.196']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a41a1d3-5e2c-4a5d-8c5c-c4cfb871ecfa", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.197']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--08a069f3-a80e-49ac-87d5-6387557d5f58", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.198']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--582c97a9-473d-427f-8298-d4f6bf4564c6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.199']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8be2b5c1-ca55-4fb1-b936-d1832a0eebfb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.20']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4b46a09d-6d1b-4241-bd8b-006b7880bb88", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66b9e881-cf8e-4b81-b991-ef99660678f0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4db82d05-224a-4d02-9f14-a1d25442f861", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.202']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1cf9bedb-687c-4406-a29c-fbead3f5d8bc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.203']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cfc63dff-f330-4a3e-b5dc-ea160438471f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.204']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4d2a04f-d717-4655-ab1e-a3bc1d01c16c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.205']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2caf6bc1-ed3f-4503-863f-9acf0f13c60e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3ceef5af-a8e9-4461-a0f8-2a1b78378604", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--93968509-3197-441b-87c2-30f7d74059ee", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.221']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cee9c4fb-7279-47da-8617-0e82ee1d799c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.222']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69c2050b-f7d0-4b7e-bc6c-7d7907d845a5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f4d69e6-0b87-47ce-affd-bee5e91bd913", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.224']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--76c107d7-2c9e-4dc9-a6ea-504b68d05dfe", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.225']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f1c8f4db-0a9e-4119-9002-c13d4c2d166a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.226']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--25fcd1c1-464d-466b-9482-4f4f94e0b87c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.227']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--613ade95-2628-49f7-921e-75444ba35d60", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.228']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ef50475b-ca11-466b-8d64-ad238d27f630", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.229']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92d04a09-159a-490c-a93b-79697f8ea5de", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4415b5d5-cc02-4685-a7db-f82e849f0512", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4448ab55-c118-4f3c-9457-2c00ff076141", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.231']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09acaca4-52e4-4f70-88eb-eed38043d921", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.232']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26fa9b4c-6bb0-4b65-b36b-8865c4ebf1a9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.233']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4ac3eae2-aa5f-4d70-8ca5-874bc9d0a799", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--66800a86-a653-47ed-8aba-89e05db8bc1a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.235']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--418e5d5d-b0ff-467d-a11b-dcf5fa68921b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.24']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6352ebad-106d-4ef8-a23b-333f6791021e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--434b2e48-cd1d-46dd-ad74-4a7a8230b012", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d4482b9-5571-4da1-b5c6-7a9878d57eec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.27']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7bcccd12-79b4-4d13-901e-b8a90761f74f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d3a1624d-d0ae-46ed-b606-2786d204b227", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.29']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff767d4e-44c9-44dc-9599-6633e80b7781", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b11e9da6-a4a0-416a-b74e-28f2877fb3d0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.31']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4579844d-e506-4acf-a054-2bc0308aa7b3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.32']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d212f8de-5f6f-4449-b526-2751e2f5f95e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4980d57c-1dda-4c7e-9a87-2ba7af0f9134", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.34']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f32c9623-774d-4832-97f5-27c8cef1b46c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.35']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc81293f-50aa-47e3-9b9c-20fe5a7b2316", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.36']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7438b7e-1c91-4000-b12d-125608e7f2a8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47410eb8-b48b-496d-98e7-f58a57668ba6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.38']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3d22c87-e50b-487e-ad79-610349d2b61f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.39']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6aff369c-c62c-4c32-b70d-8ac108959d8d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9254e366-6f8f-45ac-ab64-a446222f658e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.41']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3da2dd63-dddc-4af5-8e8e-72435d861a28", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.42']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f70a762-9201-4151-b68d-0602104a6d98", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e0938750-11bf-4320-ab05-83ae66b1d5c3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.44']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2aef8992-e6ec-45b0-8242-18f528397d29", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.45']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7592288d-6836-4949-a008-fbbfe2ff4f28", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a97bfdc5-a2d3-46cb-bb49-3206ac6e68df", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.47']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e67fb28-9557-44d4-8fb0-358ac86ff9f5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c9145af1-51b9-44b0-b6b4-10b30056705e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.49']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c71305e1-422f-4e4d-8c69-cb0e8c876eb4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--09f3d16a-fd18-41dc-9a3e-cda4b3bd64b6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a95ba8e6-f56d-441c-bb9d-ae610dc232ce", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.52']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3590e111-eb5f-4433-833f-20cfb87a1d75", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.53']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c396f5a1-aaf7-4bff-a735-cad33d86053f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--259a82a3-c9b1-48e7-97ad-b08fe60ed44f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bef2ce4c-5b2e-4043-b856-5b84f748c634", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a20168f4-bb88-419b-912b-d6468fdfce77", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6767cb93-7406-496b-b14c-8256fb82a2e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d8e5c977-1282-4997-a870-08146ca8bb82", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.59']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d2a53f4-3f8d-43bd-8f72-cd7c83bc9a8c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.60']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47fc17a7-64f6-4705-b8c5-b49d05674a20", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57c5197d-a845-45f1-a72f-508eb48c28ec", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6d2b2fb6-7b05-4c84-bc70-e2ae22be7038", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.63']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0712cfb8-f531-45cd-abce-3276c0eecab3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--959e3cef-5028-4a9e-bf23-35e158791254", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.65']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53bbec3b-d29a-4935-8f91-c5c3d7c544f3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.66']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1bf79228-5ec0-4791-8cad-0d160fc24c81", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9b3f7a11-9a43-4456-a751-44410d3f7f59", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb299ede-0eae-41b1-b4ec-4f86c410e679", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fc94762a-c571-4dbe-804d-97c4568f80a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced784d9-b365-4d19-889a-568a6a15a805", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1094a5f3-4098-4574-8a6e-a74ed25fdb75", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cea6050-5142-46dd-8f46-4336766b84d5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a72b462f-8102-4693-ba04-be6a528434fa", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43f31c52-fa04-4f5b-b9e8-d4bc639dc9e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.75']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c5d19a-29b7-4ae2-ad39-96a6af07f4e7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.76']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4c7efbb0-c1e1-487b-9cf2-439854eec101", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6364152d-67ab-4417-91e4-18c6a1d352b2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e715018b-5b74-4706-9807-57db5cdf8aa8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2a47e88-fcf1-489a-9580-f8c176bb7624", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86876d9b-943e-47d4-b44b-964c7397697c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.81']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4557c98f-5ae8-4e9a-88d9-54ba2008871e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.82']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a786202-eaa7-4a89-93a7-f65d3e648f82", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.83']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92533aa0-8583-4eee-8a9d-a1daadbea244", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--12db2075-553e-49b7-9bf9-0ad92fad10b5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.85']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a71bcc3f-c4db-476d-a8d4-ce1da30432c3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.86']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--41490e57-8583-42eb-afe8-6f81ca81e58b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3f9153de-5ac3-4db5-83f8-cbfe441cf9d3", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--272cc8f2-46a4-4869-8e52-4e8b0a89b03f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.89']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--598f0b1c-2b98-414b-af30-2a3273b8a6e0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.90']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de28e932-ea85-4400-ac6c-06bfb2eb4b98", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--03f475e8-7aee-4395-9d5d-f82164377529", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bb84cc76-a099-4c33-aa42-08e53a091b0b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.93']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6b78b958-130b-444a-ae53-82746b7e96eb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9c77f47e-42b0-45db-8cd0-e220faef59ab", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--54d9ae90-39d7-45e3-b93f-11ffcd2d04e7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--715a8c03-4cf7-4f26-91b5-95e21cd6b353", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.97']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5362e5-0a61-46ab-a211-fd7108c4796b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.98']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eb9831c-3c90-433b-b62c-baa9c15c7de4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.42.211.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9ca3c064-d230-479d-ba81-d4cfdb0b714e", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.169.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--90e528e8-e45b-4bf4-a788-30b7f7a77ccd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '69.5.23.222']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e9433ac8-0d56-414e-a0c2-317645a81772", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '71.230.235.223']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f463f251-1b54-4583-9dd8-16dcebc19103", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.161.160.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d75d9996-8eab-4cd4-8c54-8ae1490ea74e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.225.146.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e41384f5-0e2a-4361-8d4b-0d3b17e12a38", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.175.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a02489c-a84c-4924-aefb-9d3b4228fc6d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.227.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d279c7f-2140-45cd-bda7-3a731d8fae5e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.230.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35359ade-b4f3-4007-b080-200bd700aa66", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '74.7.241.29']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6d43141-3d96-409d-beae-82caa10e8fc6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.211.50.101']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--69542644-3b8f-4690-b3a1-09417abcf729", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.202']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d83a0aa-6f35-4383-91a3-0dc97009f194", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.239.124.204']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--787bd02e-4480-4482-882a-d166bb34249f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.246.68.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7adf7c11-1bf3-4ba7-891c-4c3b8392cfd3", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.247.120.190']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d5aa6938-8c38-4cfd-b135-5ffa89134443", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd1f18b9-af6a-454e-94e6-7e60f6c1d1ea", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.13']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16f96bf7-664f-4e01-8998-97ba5906c7a6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--57e89767-d074-471f-b10c-964117ac402e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46150145-090d-40fa-b3fa-f240e0518c89", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f0e41f3-8af5-4038-852b-65c39022e1d8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.122.8']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a0ce547-3636-45d8-99e0-6ea7740ff7ca", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.10']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cbc4686-caef-4594-8513-383c10802681", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b3d062-2def-4cfe-b1ca-bdd202e36bcb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.101']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6c5e6c8-5a30-4024-93a1-41b129672a0e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.102']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9650b84e-3743-4b73-99c0-041499840fbb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.103']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6762beab-3541-4a5c-903a-8351e8798146", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.104']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a81c6f3-d356-4fd1-86c1-c209e90f85ab", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.105']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fae0c2c7-4c1c-4674-8d02-672d120439ea", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9964cd9d-bfc4-4dfc-8047-6a996eb7f722", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.107']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96c02ba4-42b2-4201-b543-a58a5bcf6c77", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.108']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa755bdf-af7a-4945-b9b9-4f350533e564", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1001b5fd-e39d-4280-ae47-36e690072719", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.11']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26c16f04-2732-4072-857b-53afcb95f3db", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.110']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--15cfbb27-923a-4a84-9139-63841858ef07", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.111']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2d762301-2534-46f2-952a-babf91349b34", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--596dcd09-55cc-476b-a743-16ab4d7c34c0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.113']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--96773662-3a3f-47b5-a0b3-a07e25c6e290", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.114']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4352527a-4868-41fb-b315-08aab1b4eba1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.115']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73a068c0-7d91-4117-bf9f-e9df9ad81da4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.116']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--97d0224e-0901-4fa0-bd11-09cd032fd510", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.117']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bd3ca081-87e2-41b4-b6b2-c8aec93ba5f9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.118']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa8b2d5f-9088-4a5b-b34c-d0ad51ce2d6b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.119']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afc533d0-693b-4200-bc5a-cf4dae3fc124", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.12']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d40c60ae-821c-45e0-a96a-c63ec654268b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.120']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--63f874d4-cdbb-4cbb-a2fa-b132b10c8776", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.121']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8aae3e0-663a-4820-b458-7b03dc1fef41", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.122']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d94b997e-989a-4c36-8cda-8d8451df7873", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.123']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--afefc47f-32f7-4607-aaa4-f6b3d368893e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.124']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8f215dc2-934d-4f2a-84f4-4b691a52e92f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.125']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f396240c-aced-4f71-9e45-087c2bd7b6d6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.126']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0c53fb79-60a8-475f-972f-07b665e3ca07", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.127']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--daf8e753-605c-427b-9972-1512dd47d3c9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.128']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--841be80f-9ab1-4d64-ab95-83cbe3620bea", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.129']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bf032ce-c336-4540-81c7-e9492bdf1649", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.13']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45ae2426-2b2e-4cb8-94dc-6e1495de3898", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.130']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--943af044-1bf4-4d95-bda8-7cb8dfc7948e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--40dfb008-c531-4ca5-bb0b-8e10be5f1f61", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.132']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2b28349-29c1-43a7-8804-3d13e8412776", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.133']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e845621c-e5c3-4e33-a53f-bafaff488717", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.134']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--72e00293-e7c6-47e5-8485-f70659e27e4f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.135']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7eddc338-0a08-4880-8e05-d0ad95b458d9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.136']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2636d16-c0b6-4c77-a226-cc35a5846a3e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.137']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--92003f45-42dc-4e13-9b7a-eee641e4d1e0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.138']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--908df4f1-e5d9-4a18-b2c2-45a77b2711ff", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--861168dd-2638-42bf-8a27-da2e745ffcfb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e875422f-5ff7-47ce-a4fd-1d7cf5a18567", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.140']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--415f4d8e-5320-40e6-a8db-022755d6a9bf", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.141']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--68fa6eaf-9fa0-4b59-a145-5efcea1b1a6f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.142']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e34cb19a-d54b-49d7-ba02-8d6a751e9b87", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.143']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8a13d9ed-c439-4f85-bf8f-70b119288ac7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.144']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--44879a2f-1c65-4fc7-9095-364021f16fa9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.145']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9fcb48ad-366d-40cf-9b06-1859c819bd7c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.146']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ed64fdf-e1f6-4138-8941-f8bd4b9c7502", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.147']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--45eeda4f-fe28-4894-b475-67c04316615f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.148']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f9b58a75-84b9-4524-8df5-64e56471d448", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4a1f22fc-9c0d-4461-8c8d-48923f72bb86", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.15']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--827201e6-0462-40a0-9115-ffcd3a38a7d5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.150']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0b12bf0a-263f-4f87-8d06-05a51faacd1d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.151']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eca142ea-d528-426c-b812-ac267826be37", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.152']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--892912a8-a27e-437f-8fc1-961eb824fc7d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.153']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--acac1119-87c0-404a-81a8-441ba6088d7e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--53c3e7ee-d944-4fc3-bae8-f14eecd27b06", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.155']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2bbad52f-845f-435b-af3f-ec2bd4bf2ba7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e396a63-4127-4f4e-9f86-3b9d499d51c4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.157']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0679c46a-7f18-460d-961b-b7126ac3038f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba1e5d43-4a43-449e-a1b5-6d2b20f1c17e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.159']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9cedd06a-f867-4b31-92cc-045396e59554", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.16']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d4f003e9-cc15-4509-a38f-90dee9440454", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9094978e-cd68-4e08-8cee-76951e98bc22", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.161']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ed4a1c0b-3874-420a-9e2e-4c90d2dd9c41", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cde68b-c9e0-413d-985b-76feb4a127c5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.163']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2b5fccc4-0d79-4ba9-80e6-923de27eb01d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.164']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f935ed6e-622b-4274-9d5d-5a69bb498107", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.165']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc958b15-b12a-4e9c-9c54-f6e5293a920b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.166']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2e2d063a-9c9b-481b-8139-67e45524fe35", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.167']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--378cf488-555f-49af-b6f4-b5823237990b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.168']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86263375-e5fa-4701-9374-5047c8c41dfc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.169']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf371fb9-8e82-4b93-b560-e74f9ef25ae6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.17']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--49399c22-ce12-4e33-af05-0804be45b4ae", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.170']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b18af023-b8bc-4c1e-ae35-702017723471", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.171']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7830df2a-654f-4131-85cb-e43070bec37a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.172']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5ec16020-df4c-4128-a6b8-6fd6bfd781a2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.173']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--67ef490c-9fb3-4b37-9184-a31d774a3ea1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.174']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--246ba778-edde-4245-91d0-83f4bdbebe28", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.175']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18d6d57f-4ff9-4732-a4ba-10a8fedee453", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.176']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e32995d7-3265-42f7-b0f8-225876868377", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.177']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9c203b4-070a-4ffd-bcef-880d3ecc1af6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.178']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--60715f12-00db-44b8-8b82-c78248397a23", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.179']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--baf49183-315a-433f-9680-84247a4f9ebe", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--46990ff8-d9aa-46ce-becf-6355f0353a1e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.180']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2133bb3-ef02-499b-98b4-05d5f38d57e9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.181']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d218d0df-1dfe-406c-8d28-fc5bad7a4d2d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.19']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7a37b5ac-4116-4b1c-9454-6676b478e98e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--62b60522-8d19-4643-8b10-2ebf05408d70", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.20']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17001d36-3340-41ec-b79b-06cb66d57b44", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.21']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9d1aeea6-e045-4440-84e8-9037ace4c75d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.22']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--47ce58c5-04f3-4c82-bac4-efe9b825fda2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.23']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--422c935f-d326-42cb-b318-8838d7ad5d72", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.24']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6c5e9057-3839-405a-b932-d9e69f6ae89f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.25']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--74cdfc81-5fc0-4607-ab37-d605c8bc2cbb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.26']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9150d2c0-a179-4fa8-8095-a00158dc8e11", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.27']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bce88072-0210-4553-a772-f6e6bd3f1800", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.28']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5eee6e51-cae4-48ab-abe1-bf0a9db355b8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.29']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--032804aa-7546-488c-8018-9d01c977b002", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.3']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2c5178cc-d0d1-40d5-9b78-d469e1f5bf70", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.30']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bc6f3764-47ab-4e2a-bb21-49d2bc5815e1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.31']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb1ad34e-6b16-4f9a-a7f8-e115d18f7a42", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.32']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ab9ea132-3577-4085-9047-3cce0b782ead", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.33']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b429589e-9aa7-42d5-805d-409d9a8036e7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.34']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6dd84eaf-3d92-4f5d-90d2-ceb3f9beff04", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.35']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b0ce686b-9aba-4860-82e4-c3a5d620eede", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.36']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2da7d94f-01bb-4dd0-8d39-70a82bdc6e88", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.37']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6128af3-0c92-4fb8-9415-5999821854e8", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.38']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--dab1672e-a8f8-4f57-a1a5-8f011b1c8e22", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.39']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a000233-1b7b-4c5b-a80a-c1e09ca7f4e9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.4']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--317d656f-e428-46d0-8ca4-dfc2d345989b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.40']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--81f0d181-356f-4a66-a833-32c6868f9e3f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.41']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--02bb0d42-6008-4cb5-adcf-f8f58414efb1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.42']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0330eaf0-4a8f-4a84-93eb-3936ab7a130a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.43']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1a46fe13-d32d-41f6-88c7-784ca0778f03", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.44']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f3e4d1fc-da0d-418c-b6ab-2d3243493695", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.45']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--85850378-99bd-46d0-a5f0-de24586981e6", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.46']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d378cfb4-9a4f-4fe5-a102-d3407a77b7ac", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.47']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--de391b73-5a08-4e3d-95ad-4a4a0c9b5f40", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.48']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--73486344-304f-4b2f-b9a5-f632658669eb", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.49']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3444681-8f3f-4377-bca6-829d04faa0f9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.5']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--762d34cb-db7f-49a9-be7b-1e999c8a5100", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.50']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f2766f83-ede4-4cb1-8b20-0d09acedf752", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.51']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19a1614a-b425-4523-8277-eb184c39ade5", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.52']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d8c10c4-7f25-408a-8851-438b76df703d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.53']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--130ee2ba-dd04-4072-b5b9-aef61ad8b4ab", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.54']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c214e169-d34a-489c-bdd1-e134233e99a1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42f1d1cc-8172-4b99-8563-bb12aa782f70", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c74714e1-9ed6-40d5-87f4-a2ef81a237b9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9eb00e87-050a-4bc8-8fb1-456ff778bcce", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a63bad11-2b21-4478-a6fc-09b56417a263", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.59']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cc06dfe5-baf4-414a-9bcf-702e1475916e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.6']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9af34cfb-5219-4f5c-81b3-8ceb3e324d69", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.60']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--199dbcf3-abeb-43d5-8371-edf4ac46aeef", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--660f2c58-a024-4540-8808-1a35e8638186", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.62']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8d0672d6-6b02-4224-99ba-6355af0786f7", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.63']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--060b7aa9-4916-4624-9b2b-16557af2e15c", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.64']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--656e54c4-d5e2-4647-b827-1949e6a2e9dc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.65']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eed4187e-c914-4c66-9180-139b6260c95b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.66']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--26e604b3-a212-4b09-9978-14e9106ce5d2", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cd65b0c9-3ffa-46a0-8b4b-773ca62c1b41", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.68']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5cf5c0ed-7ffe-4d46-8308-0e8dd3a74286", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.69']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--35d5d414-34e6-4770-a852-7ed93ee085df", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--cf722387-a6d1-4b7b-bf96-79a6eab7393e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--48602fc0-f865-4449-ba63-8193352714c4", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c2f9aabf-92fd-4467-96d8-99af88b16d80", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bdc82a00-8118-41fb-beb2-dafa99e5fe24", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--42f5eb2a-96a5-49d4-a7ca-4e8a6f5c37a0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.74']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--19fa3f03-4936-425a-860a-88d8d3792b95", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.75']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9e16596a-bfc7-4187-ad33-c51a6529fb01", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.76']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d2662767-816a-4219-87d8-0d2e80e8bf61", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2137f7f8-5f58-495e-b5dc-543702f26e9b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.78']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4fb2e944-168f-4838-9d50-286c326c948e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11e33d1d-e903-4c76-a95e-3dabe31179a1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.8']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bcd87c2d-7995-46ca-8190-072576165418", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.80']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--28d186d0-72b8-47e4-8409-f263f5705f15", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.81']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--be07d3c3-681e-4d56-ae70-6f50b05f3e75", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.82']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--58107399-8b2b-4fbc-bf03-e03093b077d9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.83']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bad7f93d-16cc-42cb-b303-fea265fb367f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--70124300-1957-4693-95b3-645a9fb23708", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.85']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3add3dd-d3ac-44ae-aa7f-c6b90410f46e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.86']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e4ca77be-d263-46cd-b7d4-a9f69624e1a1", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.87']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--077396e1-3801-4b6f-ad3d-fed257876d4a", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f7d20051-ff28-4e1d-81e2-e5983b6be158", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.89']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ff2514f3-1f2e-45b5-8276-e047a1bd584d", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.9']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0567da39-f7c7-4971-8bdf-d870f07f6bcc", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.90']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1e94fd9b-944d-4be0-9a6b-1b2cac5ac29b", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7f9ff354-2adf-4b54-a5e0-2c4433f49210", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.92']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--685d62c4-26f5-4d93-94ea-63c1cc1afee0", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.93']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c6b43ab2-d290-4804-8e0e-e4f9cced5145", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.94']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--fa284c84-02b6-42bd-b7c2-a42ad30fe05e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3cc4d65a-baff-4614-bd2a-aafa9f7775bd", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.96']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a7482c6-2ea2-4afb-ab53-4d0624dd730e", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.97']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1f39e8ec-c322-4a3c-96cc-48629049285f", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.98']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c4d53075-adde-4964-b3cb-fa30e7bf6ee9", "name": "Malicious Host", "description": "Observed: FTP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.65.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ftp"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9a7408fa-baf5-48cc-9744-29184d6bf468", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.90']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5623eae0-b33f-42b7-a7be-d8627409ab4c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '77.91.71.91']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82f51d2f-67d2-4168-847d-3364887f9b10", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.137.3.38']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d28eb363-1f56-42c9-9745-2f2ae6ab849d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '78.81.174.139']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--6a48840b-cfed-499b-b9d1-7c5d31bb3f72", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.106.10.67']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--37954cfa-8795-49b0-89bb-d56042263315", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '79.124.24.79']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--86b6e557-891a-4366-978a-38bd8900d00d", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.217.145.188']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7e803d4-7d6e-456c-bf48-1b407ffa26c9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '8.243.119.61']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2db807ee-a5d4-420e-955e-07ce857a2ba5", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.92.234']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "name": "Malicious Host", "description": "Web exploits: aws-credentials, php-backup-grab. CVEs: CVE-2002-1149, CVE-2019-5418. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '80.94.95.211']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--e5eb070f-5241-4ca9-8849-3c4601ad41bd", "relationship_type": "indicates", "source_ref": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--1aad1f8b-7941-4798-808e-95a0060e5c3e", "relationship_type": "indicates", "source_ref": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "target_ref": "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--fd07257c-6da6-4014-8bb9-59625613ccca", "relationship_type": "indicates", "source_ref": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--dbaa54cd-b9d3-4ac9-b625-12ac25829c5a", "relationship_type": "indicates", "source_ref": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a9542e6e-6804-487e-a0b7-5c3090c8bb1c", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '81.192.46.29']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f8e116fc-8be6-47bb-a2e4-12c3aabe3255", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.152.132.24']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1561d3ca-34f8-4c4f-abb0-e2966e9002ed", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.167.201.148']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f61c41-94f8-4ac6-903d-316ad8c434fe", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.234.12.70']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--8ea9919e-a7e7-41ec-ae7b-394fd41b8d80", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.36.62.156']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--78f739f1-f60f-41e0-bbed-3b685988101b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '82.86.134.154']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--092acce7-5b92-4a38-9f26-5a1d11b5525a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.110.171.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--51817b48-78dd-45b4-a190-aca4de1d0f40", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.217.213.120']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--217c17c9-eff3-4ab1-aa57-6f1bd11fbba9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '83.49.66.165']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--11b34389-c67c-484a-9d4e-67c003c826fd", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '84.13.136.230']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a3de055e-3679-476e-b598-bc1aab948115", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.11.167.7']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f4cb7a55-f60f-401f-801a-630a204b6163", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.133.193.72']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--1b191f29-195e-42fa-985f-3966a19dbc89", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.154.168.106']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c29b9ce9-890e-4b80-95bd-f6191c3d744c", "name": "Malicious Host", "description": "Web exploits: wordpress-wlwmanifest-scan. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '85.204.70.88']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--56b8bd63-cba0-49c3-8389-fdd6dd383903", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.193']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3116acc8-d001-4a85-b87c-ea091205cf7b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--04d17887-d118-4ef0-804f-868ce610a311", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.195']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f21ea352-7471-4204-964f-3174735d7723", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.196']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--61897aa8-31ae-4b92-bb62-98a31febd162", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.197']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f43ac588-c8c5-4468-b6f6-5a5d3802f68f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.198']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7c9d7ea0-dfab-47b5-8f4c-06b86f4184f6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.199']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e308792c-d8f4-4f6d-86aa-230e216411b9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.200']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c035d8ad-071b-4670-a029-ee6ce1fd59b7", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18e0f940-af21-4e40-8356-1c3089104482", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.202']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9f58eb68-e139-435d-b72a-5fbc70a10d73", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.203']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--82954662-31ba-485b-b282-1cca5ba69d64", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.204']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e1ab0f09-4695-4619-83ad-aff6054f9847", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.205']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5b0833d1-4298-4e18-aa4b-27744aa331e6", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.206']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--da7bc62d-8332-4437-830b-c39b93ad214e", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.207']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--286312be-4fa4-43cb-85c7-c5c114b91673", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.208']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eace909b-732f-464b-afc7-403e189cf77c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.209']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--9af22944-3f3a-4073-9352-51eeedfa80e4", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.210']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e3b09310-3b4f-4fba-a3bc-65740cbf468a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.211']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--551f7973-46d5-4c2a-99dd-6e37dd812629", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.96.212']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ea23d6af-50ae-46dc-9c26-9031e8d89775", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.55']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ced548bc-288e-4dc6-b1bb-cc0ff4572259", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.56']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--43657b0e-810f-4ea3-8ef0-24073e11b432", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.57']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--94bf9cd0-33b1-4478-87be-dd74cbfb2cea", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.58']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb77dce8-9bf3-4df1-9d9b-0b4f15bb5830", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.208.98.59']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--e7bf32e2-abfd-4ccb-8e61-7cd0dd4fdd4e", "name": "Malicious Host", "description": "Observed: REDIS activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '85.217.149.2']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:redis"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--214dfaf2-3dc8-4000-8773-d6c26f526f9d", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.199.167.10']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--395790ef-ece6-43e3-9298-0a7db9040485", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.21.44.205']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--16971f00-eab2-4a5c-b3d9-600552287a74", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '88.228.29.194']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--ba060711-92a4-4d9f-95ac-22b17c565fb9", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.249.195.231']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d30d793d-6ac0-4b48-9875-7c32f7e69b99", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '89.25.89.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--4d3a3e83-384c-44e1-8eff-23fb65c8567d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.192.46.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--eb2f0dac-d1d3-418f-b354-7de65c36921a", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '90.21.149.109']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--07832cdc-8e2f-4e2f-9a3b-0f4c7247c613", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.135.81.124']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--18c90207-0b53-4f0b-933c-e21708ea064f", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.148.244.131']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2cf962a5-8c73-4188-a53f-6305a50f89ff", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.149.160.162']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3407ca93-7cc5-404f-a373-dbfda031b5e5", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.230.168.112']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c7d19b36-9215-4a92-82a3-0f503f97cd66", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.218.149']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3b13acc2-64f9-4917-951d-64bbe99495a6", "name": "Malicious Host", "description": "Observed: SIP activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '91.231.89.160']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:sip"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--98427143-c3f3-49c4-9f74-e59ad6ab2982", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.14']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--0bbee6cb-fac8-4555-afa9-172ffd387228", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.71']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2398c7c1-80bc-4fb8-81d7-5c3e4f4decf3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.118.39.77']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--c008a04e-8f02-43d9-a942-450668a313b3", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '92.47.46.174']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "name": "Malicious Host", "description": "Web exploits: aws-credentials, mitre-t1190. CVEs: CVE-2002-1149, CVE-2019-5418, CVE-2024-23692. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.123.109.228']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418", "external_id": "CVE-2019-5418"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692", "external_id": "CVE-2024-23692"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--479d4162-746f-48f2-93f2-5b6c0e11ce19", "relationship_type": "indicates", "source_ref": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--9a9f48e3-bbd7-48af-98f4-2a8b4f0fffab", "relationship_type": "indicates", "source_ref": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--57848cf6-cebf-4897-b115-6a5a5b6bbc32", "relationship_type": "indicates", "source_ref": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "target_ref": "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--67433682-af9e-47a0-8f16-a94daeced74a", "relationship_type": "indicates", "source_ref": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "target_ref": "vulnerability--df006803-2730-4832-af24-801eeaf41481", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--d0718acd-ed4c-4340-b84b-9d1edf81dde5", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--5be41ca9-dea6-4f49-859c-80feb51ac675", "relationship_type": "indicates", "source_ref": "indicator--d0718acd-ed4c-4340-b84b-9d1edf81dde5", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--6eee4d79-cc21-4ed0-bf11-d0a690a306c9", "relationship_type": "indicates", "source_ref": "indicator--d0718acd-ed4c-4340-b84b-9d1edf81dde5", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2a92483f-d29f-4625-be9d-382b72482551", "name": "Malicious Host", "description": "Web exploits: aws-credentials. CVEs: CVE-2002-1149. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '93.152.221.34']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "credential-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1149", "external_id": "CVE-2002-1149"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--8eda6b72-e4a5-49d6-8e8b-85a68aaf531d", "relationship_type": "indicates", "source_ref": "indicator--2a92483f-d29f-4625-be9d-382b72482551", "target_ref": "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--49800db5-2bca-4488-8032-8264a355129a", "relationship_type": "indicates", "source_ref": "indicator--2a92483f-d29f-4625-be9d-382b72482551", "target_ref": "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--edba19d0-0a6b-48d6-99ad-f67c9bd02afc", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.177.118.100']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b8ab7c3a-e267-4ebf-a07a-d981bc4213bb", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.177.119.36']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--7d2a6a10-f57b-4eae-b92a-10a85f5c7de0", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.47.53.182']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--b3cf9499-4420-4633-a8dd-edc316bca570", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '93.87.143.135']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--555b6c4b-3637-4636-964c-a10f6a8b17ac", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.160.184.84']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--17a03016-96c7-4868-8f42-0aff7da1d0af", "name": "Malicious Host", "description": "Web exploits: openwrt-luci-rce. CVEs: CVE-2023-1389. Sensors: revproxy", "indicator_types": ["anomalous-activity", "malicious-activity"], "pattern": "[ipv4-addr:value = '94.183.174.95']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}, {"kill_chain_name": "mitre-attack", "phase_name": "initial-access"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}, {"source_name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1389", "external_id": "CVE-2023-1389"}], "labels": ["sensor:revproxy"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--b881d44c-633d-48bb-8f85-cf4bb80e81dc", "relationship_type": "indicates", "source_ref": "indicator--17a03016-96c7-4868-8f42-0aff7da1d0af", "target_ref": "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "relationship", "spec_version": "2.1", "id": "relationship--075c40bb-72d2-4acd-9b09-31c900a0b330", "relationship_type": "indicates", "source_ref": "indicator--17a03016-96c7-4868-8f42-0aff7da1d0af", "target_ref": "vulnerability--322c2286-6e9c-4af2-ba5f-bf956a058e85", "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--5a47bed7-e471-462e-a5fe-21b8aa579aee", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.187.17.201']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--13b6accb-0dd2-4cf3-97f4-e542e6aba82d", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.20.62.126']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2fe0799c-532a-476d-ab1f-0aaea505a24c", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.33.211.18']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--3655cb23-d494-40a8-9931-cd5078d8e162", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '94.55.52.104']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--956144ef-88b6-4bb7-a936-695820882ff5", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.182.125.158']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--644e2826-33a5-419b-9861-da2b3613a679", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.182.125.99']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--bddec6c8-8732-4ad0-8468-090e73f24038", "name": "Malicious Host", "description": "Observed: TELNET activity. Sensors: vultrtokyo", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.215.223.32']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:vultrtokyo", "protocol:telnet"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--2482e7d7-87e0-43b3-ad08-3f1adb1c476b", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.26.32.73']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--f5c0d34e-bcb3-4bd6-b9f3-eb4b343deead", "name": "Malicious Host", "description": "Observed: WEB activity. Sensors: cfglobal", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '95.32.153.118']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:cfglobal", "protocol:web"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "indicator", "spec_version": "2.1", "id": "indicator--a67728db-4fb7-4e93-aba9-2d60ccf152fd", "name": "Malicious Host", "description": "Observed: SSH activity. Sensors: digitaloceanlondon", "indicator_types": ["malicious-activity"], "pattern": "[ipv4-addr:value = '97.74.236.4']", "pattern_type": "stix", "valid_from": "2026-10-13T00:00:00.000Z", "valid_until": "2026-11-12T23:59:59.000Z", "kill_chain_phases": [{"kill_chain_name": "lockheed-martin-cyber-kill-chain", "phase_name": "exploitation"}], "external_references": [{"source_name": "jamesbrine.com.au Threat Intelligence", "description": "Daily threat feed", "url": "https://jamesbrine.com.au/2026-10-13-stix2-json-feed/"}], "labels": ["sensor:digitaloceanlondon", "protocol:ssh"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d624fc9-c01c-4bd1-955e-791368093f59", "sighting_of_ref": "indicator--3a74cae5-506e-4c96-8a17-e4d5643d42e2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c94c8f6-6d7e-47ae-87ad-812647e291c7", "sighting_of_ref": "indicator--8b136fe2-e68b-4081-9ca0-816c315cb9bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c559937f-49ac-4665-8e10-4230365c6572", "sighting_of_ref": "indicator--273e7123-f0b9-4e62-8c82-aa2762d9e775", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbe1b182-da39-436e-8c7f-6ced80a1172f", "sighting_of_ref": "indicator--4a5c9cc6-af8a-4314-a255-8f010b1c77ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfce28ef-8b47-43fd-bb7b-6d648d3b6241", "sighting_of_ref": "indicator--c0feb658-de21-4b16-9c29-773550967fa8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08acdba6-5873-45e0-b17f-a3c014a734fc", "sighting_of_ref": "indicator--d5531bfe-66a5-44d1-84c2-d40777ddcef8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cba09c2a-c749-4ab4-8c18-f42800983526", "sighting_of_ref": "indicator--195f0b17-1ec4-477e-a8a6-14142edb6877", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78468303-f9ed-4e5e-83a1-959d3fd51db3", "sighting_of_ref": "indicator--f77d30a6-94eb-4198-8723-534b6893c4ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ecfcef6-42a6-47c8-b1e4-867606e26277", "sighting_of_ref": "indicator--e5de6251-edeb-446e-abca-3fa6dd863713", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85c359f5-d328-48d9-a379-179e3e1e9a71", "sighting_of_ref": "indicator--5d09af14-6143-410e-a52e-ab97cb4c614c", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e4400d4-f7be-4455-8fc2-93467ca0431a", "sighting_of_ref": "indicator--4f70afcb-1f24-4bd2-85d5-cb071de6dc36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd189600-d331-471d-8fe0-d8eecbd5e37e", "sighting_of_ref": "indicator--5bc067b1-402c-4f2d-a916-e9c9847955e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0dfaf3d5-0840-4e9f-925c-1501724bbfa6", "sighting_of_ref": "indicator--4077466c-f49f-430c-8eda-67dfdd7368d8", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--831f993c-4ec9-4e9f-923a-7a423a6ab79c", "sighting_of_ref": "indicator--e7c9962c-f9cb-4b3e-a4e8-c73b64738ae4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac56cd0-1bd1-49c6-9450-47da3ff98a8f", "sighting_of_ref": "indicator--636babeb-02c2-4259-a820-9e37c0ff21c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4ba1497-cdb2-49d0-83ad-d20bf301ab02", "sighting_of_ref": "indicator--04d20ac8-1bad-45dd-8d13-03ee79d593a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fcbd23fe-6004-4734-8185-bfe0bfa0049c", "sighting_of_ref": "indicator--44ccfabc-c895-4da4-97bc-e551f49a639b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21b7a7ec-3c83-4977-8848-dab8da048059", "sighting_of_ref": "indicator--2b1a3798-0024-4dfd-aba4-6546b9250a7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--745934d0-b88a-4080-9b8b-cad53268280b", "sighting_of_ref": "indicator--a4099919-a3b4-41ae-a106-6ef4fa1c612a", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5d62f67-f131-414f-bef0-814051971098", "sighting_of_ref": "indicator--e67f2e49-b587-4aef-897e-546bf572ab9d", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32a3f046-bd8e-45d0-80d0-c8eb03e73be9", "sighting_of_ref": "indicator--ce54219c-952a-423a-b571-9b06b3248104", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66eba294-de2d-4a26-b7c6-024ded362662", "sighting_of_ref": "indicator--4365f12c-0aa1-4c68-b150-871d8cb89950", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a7b013a-29cc-45d8-a05e-21b594733b10", "sighting_of_ref": "indicator--3a6bcd0a-1c73-4648-98a8-51a2f6de2a63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5838ff0-8869-4d53-a373-4f4871028ff1", "sighting_of_ref": "indicator--640d2b6a-2061-456b-a04a-015d1fb7da6c", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54d994d3-f583-4170-821a-978a13b5df7a", "sighting_of_ref": "indicator--5008bbd2-7ec0-4f3d-b84d-ada84e6b433a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80610e3-ec2f-4de8-b63b-8cfc64a85fcd", "sighting_of_ref": "indicator--a4c96478-eff1-44af-9c2c-6543ede82e21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05dc639c-496c-4b27-9b27-413c48b1c434", "sighting_of_ref": "indicator--5e87f55e-c674-4c44-ad00-d56e4d467227", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d399bd2b-9ba2-433c-bd26-9610c08c07be", "sighting_of_ref": "indicator--9be30c2b-7189-43e9-94e6-11d5f0acde00", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e96d3fd1-ad14-4ec3-85aa-0085cc1e90a1", "sighting_of_ref": "indicator--7d352620-30b9-495c-8977-20192256aa19", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29ea4b17-a51a-4d63-b79a-d5d0b7bdd7cf", "sighting_of_ref": "indicator--f9778319-f61a-402d-84f9-13985cda0183", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e210a833-0972-4fbc-aac8-de0bcf04a440", "sighting_of_ref": "indicator--060f28b8-4e27-46c2-a786-a25ddccc2ee7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6180d61f-3adf-4c42-a0f7-6d2d6ee31925", "sighting_of_ref": "indicator--55a62858-5b33-44ae-948b-99da7fbee0af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b13cd153-a3f6-4bd5-ace7-8600d8045493", "sighting_of_ref": "indicator--d6cc333e-1163-443a-b58e-832c09faa80f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f76b632-0130-49a9-8fa2-35c97ac4cd03", "sighting_of_ref": "indicator--b6a7e2f8-873c-491b-a9e8-bd1e05ebf8d0", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a05feb0b-8b4d-407d-ac6f-706a266f57c8", "sighting_of_ref": "indicator--a3774059-0c0e-4a80-a908-11c9e006a229", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a600a20c-d652-45aa-a90b-3b5bdccb081b", "sighting_of_ref": "indicator--fed11ab4-5a6a-4d0d-9d6f-0b905cefa2d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--102768cd-4332-42c7-841d-2abfcfb07943", "sighting_of_ref": "indicator--9830a89b-100a-4eea-8684-4a91933f1a1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2c9927ba-e2a3-4c2a-b683-6dfff20b2f18", "sighting_of_ref": "indicator--47aa6aff-4edc-41db-86c8-2df9b5697445", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ee5238f-7c23-4f64-a3a9-ff6a1e65b8e8", "sighting_of_ref": "indicator--ec58066b-dc20-4b14-a605-ddbafeb32b0b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e5b86ca-ce29-4f42-b19a-9a43a8cf006d", "sighting_of_ref": "indicator--be968095-4e94-41f6-8770-7893fea617ba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a27e4477-6385-4ce1-b5ef-e99ba8c8af65", "sighting_of_ref": "indicator--3d172290-6155-4beb-9a6c-99adcbcfe363", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3950ec72-bce2-4680-8c13-9f7c3a4b50bf", "sighting_of_ref": "indicator--0ea7698d-b5ba-4589-b43c-c1cb648c4268", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a40ebbcf-7160-46b5-a5dd-f23902c9fed3", "sighting_of_ref": "indicator--b0b4e2d1-7c98-4668-bb79-0b90f65e95e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77c166a7-8dab-4c25-b2ce-3db9087e628b", "sighting_of_ref": "indicator--6603f939-4053-447b-b194-b15d68da9672", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f43d5228-1eea-48fb-85d8-6a02982610c2", "sighting_of_ref": "indicator--f9b9362b-1486-4115-84c3-d70aed1883a8", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f45917e-6804-463d-a3a8-0f62c4909a31", "sighting_of_ref": "indicator--28edb24c-9beb-442f-862f-70747ad2cabc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32cf3636-198c-4c7b-9838-35e5c526baa2", "sighting_of_ref": "indicator--c13ce4a7-9df5-44a6-868a-db83d3d1f6f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f91e36b2-e1ce-40ee-9815-39fb31dd8994", "sighting_of_ref": "indicator--101f60e7-bf03-4a82-8b3b-123d2d5199d4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9461d6bf-dabb-4e86-b574-725684a4e1b3", "sighting_of_ref": "indicator--56f8510b-d035-45e6-b4fb-c00a70ee7ff4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96d7938e-5ba5-4940-904f-6625e68ab935", "sighting_of_ref": "indicator--b4fd0d92-fc18-4b7b-8752-e105141c98af", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f2be3e31-c9c4-4a6c-8da3-952dda2b8601", "sighting_of_ref": "indicator--150fba5f-61a9-4ba2-a5f5-aeefe8cc28e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f7afe27-da3d-4a35-b8e3-cf19c9f3dfc0", "sighting_of_ref": "indicator--995f6651-e714-47ee-8923-817ec092095e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2abb473-2798-4e2c-942c-352d94d54872", "sighting_of_ref": "indicator--c94593ea-040c-49f7-a7b1-1f34eaba823f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1de98e38-2800-4528-a842-905f10c5d0ee", "sighting_of_ref": "indicator--208e4b96-3d8b-47c5-802a-79d8899106eb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92dbb8c7-5f3c-4efd-a3c8-453e04374947", "sighting_of_ref": "indicator--7e7a798b-0876-4782-8ded-aa5b813a7e05", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae181e0-1706-4567-b2ed-2ccde31ab884", "sighting_of_ref": "indicator--e732b0c6-dfd2-46c6-8081-1299e323dcea", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45863f0b-71a5-4d0b-a169-4ee17d979e79", "sighting_of_ref": "indicator--7df08a0c-af0c-4dea-9eab-460444744cb8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5687a420-aba7-4937-a4e6-9405c93446d2", "sighting_of_ref": "indicator--947eb785-1d18-47d0-8123-096f62a33fef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a578e0d0-525e-4e86-84fc-0795c1530ed8", "sighting_of_ref": "indicator--c2774b25-6065-46b1-9357-482c3ebef62c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cff9e3af-97a6-47b9-b67b-cb193272ed18", "sighting_of_ref": "indicator--a8f027a3-e671-4ff3-83ef-ebda1a37ed41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20acd9a6-d10b-40ab-a7a0-f931065714f7", "sighting_of_ref": "indicator--fd797057-18b8-4566-a53c-6fc8bc1efed2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b95ccb20-5c27-4a75-900b-c3499f968a6d", "sighting_of_ref": "indicator--24d68cc7-82e3-4858-a6ac-067218384e86", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--874a2dbb-89ee-4c17-95d8-59da8d1488a2", "sighting_of_ref": "indicator--37c08c93-97ec-4559-a053-700f438f7941", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7da3a367-2ed2-42e2-8628-50090c746c6c", "sighting_of_ref": "indicator--b9e5fe9b-d036-4fa0-8eaf-435f2934f7f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1350833f-b2d5-4cfa-9879-c9a1b942b6d3", "sighting_of_ref": "indicator--878d75d4-e32a-44da-9d2d-f92f3e6d8103", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72862aad-c9b8-4943-bb25-0e18fe9adca1", "sighting_of_ref": "indicator--e2804ee1-a27b-4a86-859f-16d28df05850", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d2f0f2e-0a15-43ae-971b-fdd73ca35e30", "sighting_of_ref": "indicator--394ea9ff-562b-4adf-a60a-d6bc24686048", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--535f5656-07b4-4898-825c-26dcc119dba2", "sighting_of_ref": "indicator--16f10b76-7c7a-4074-a825-cf109285ed34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6520c61-eaf6-456c-a61c-542b61807bf5", "sighting_of_ref": "indicator--ae028069-4a8b-418a-b5ef-bb27879310d9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53015d1-3b39-4f46-b147-aa6d738da1ca", "sighting_of_ref": "indicator--46e16773-17c5-4c5a-8f2f-d998a4357894", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7088c4c7-e761-401b-bda8-3e7f830a2734", "sighting_of_ref": "indicator--bedbc3d1-d53e-4011-b1c4-e4d4fe6a5e64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--639d19b8-d4db-4662-aaa7-9f3205ef627e", "sighting_of_ref": "indicator--069ae35a-de0d-4184-bace-27378d0ca391", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ba8321-a276-478a-a4ca-1fa2dc25ba6a", "sighting_of_ref": "indicator--4bb20872-21ba-498b-a8a1-d6f082a1d993", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f72948ec-1d40-474d-854b-1bd7586204fc", "sighting_of_ref": "indicator--df7de67a-ae46-4ccb-86d1-80a8889aac7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--940c8392-e1c8-480a-a8e4-e0d032dc2934", "sighting_of_ref": "indicator--914b596f-248c-4441-a084-4ec9c84e58ca", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f9fcde-79f6-4fbf-8bdf-ce888722ef66", "sighting_of_ref": "indicator--3c0d4c11-57ad-4b9f-9b36-aa5ae0095044", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78a715f4-835e-40b0-98d5-65af5642e871", "sighting_of_ref": "indicator--e79c3a10-a37e-4cda-a0c8-45b709a4c3eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6f2c53f-9de1-44ee-a3eb-9bcfb750d74b", "sighting_of_ref": "indicator--8e6ac339-cce5-4397-9fed-b960934d6137", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb97ab7e-42fd-4ea1-b85e-5c53b2a181ce", "sighting_of_ref": "indicator--116f8141-d907-45f9-a4f9-8d89dbd602d6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--828032c2-f53c-430d-8991-35241f6df362", "sighting_of_ref": "indicator--4aae9c7f-dd66-4f91-aaaf-9c95efa5ee4f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cbb6314b-726e-40c2-8bc7-9b43930e30c5", "sighting_of_ref": "indicator--5a498e58-c999-4809-a4d9-45728a2ebda7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4b8ed70c-dc5a-4338-8aac-5159f8fa70d0", "sighting_of_ref": "indicator--575995ea-8a89-4c06-9216-1a57bc050632", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cad22d35-fb6f-48d3-8d82-85b232f0de9f", "sighting_of_ref": "indicator--7e00a9c6-f6a2-4003-a49e-577beca8c1bc", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc97f90a-5a2e-433d-a0ce-9456c2af8220", "sighting_of_ref": "indicator--0af3d0ad-e563-4c61-9405-a3716341b5f8", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7590b728-55f9-4c9a-a795-9dc63849114e", "sighting_of_ref": "indicator--d4774263-d32f-4006-8f52-b7db7a702c23", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4be396-95b6-4041-8cac-bfd71623529f", "sighting_of_ref": "indicator--804b98a3-3d64-4f23-a50b-5e06e71702de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--acd8e6ed-f73e-4943-b92d-a2c821733b9b", "sighting_of_ref": "indicator--cb5d593e-f564-4e32-b6ea-852037dcc196", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c8fcb6c-2be4-45de-83d2-3db7ee2683c5", "sighting_of_ref": "indicator--f148ff5c-8b56-469e-92f4-012b66913778", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e705408b-397b-4a74-9409-fdfccb4596fa", "sighting_of_ref": "indicator--87333289-fd9b-41eb-9573-9d6329cb5562", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89db6774-6e55-4cbf-99cc-88ef17684653", "sighting_of_ref": "indicator--9ab9ad7f-c620-4588-9003-8210e201182a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7efbaa23-d0b3-4985-b0d8-960c2b60a87d", "sighting_of_ref": "indicator--1b0354ef-97c4-4369-9a30-898aba142511", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fda4eb43-bae7-4c21-829d-988508d6ae73", "sighting_of_ref": "indicator--eb4af4c2-582f-4861-be4c-85a101f37fde", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26f64cf1-91d4-4798-8c77-39128d456a1b", "sighting_of_ref": "indicator--0b46a870-2125-4e9f-b18f-b6db8fa65ee6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--569980cd-a2a5-4f0f-91af-cfee64b543e4", "sighting_of_ref": "indicator--42ae1522-c41e-43cb-bf3e-c1b1e928fd51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0386a71e-5163-4fb8-8b43-d4ffd75eec85", "sighting_of_ref": "indicator--e1305aa5-a38b-48c9-8141-998ba19968d8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bf1f817-2117-43c4-9071-feeef904fa92", "sighting_of_ref": "indicator--43c9f478-176e-4146-814d-a8b9d718d5e0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--82a0c404-ed77-4308-a35e-cc4f64eb6497", "sighting_of_ref": "indicator--2e576341-4948-4680-b55b-de89a84c92af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19621605-d169-42ca-9ed6-0ae64148af4c", "sighting_of_ref": "indicator--a4cfa277-8a20-4377-9f1c-412e0d348752", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e85dd59-99df-48ee-86d1-628c8fe42d97", "sighting_of_ref": "indicator--cea6b492-9628-4893-9243-de0cb051e54c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6376cf76-3d2d-4957-ab82-222f40bbe3c8", "sighting_of_ref": "indicator--a5350e89-a24d-4569-aa03-a616e29b9c4b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--456a6f50-13ee-471e-95a7-2bf7fce65bdc", "sighting_of_ref": "indicator--3976900b-ed17-46fe-b1c5-666f45107fd8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02d0762d-ab75-43fd-a1e2-6de213a4d928", "sighting_of_ref": "indicator--3d077071-87e6-4328-b252-61233578cde4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c3e692b-d7ac-4f71-a7a6-a814e526d108", "sighting_of_ref": "indicator--4f600c33-c7ea-45e1-876b-8d501b4de5cd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f95a43-6da7-4842-be6a-da5e223fac21", "sighting_of_ref": "indicator--dbc70084-db50-4d71-9802-dd4a620dd2a2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d81b6d48-ffbb-4b27-b5f7-a26e34b03288", "sighting_of_ref": "indicator--f2bcfb43-ccb7-4f25-ae0a-ddec9e76f749", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67c7d50a-2690-4f7a-9c0b-60707696d911", "sighting_of_ref": "indicator--51ff6497-3fde-46bc-9017-994c6b5bf00f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef3aa972-277d-4fd2-ba5e-5d4b8b35a7af", "sighting_of_ref": "indicator--306fcf0f-fc71-48d3-bac8-80542e7c5f5e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4842222b-dcba-498b-ae23-bc3e62622058", "sighting_of_ref": "indicator--e86c03aa-dba0-471d-9586-be21b5bbb3a4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e2f07f-bcf7-4393-9603-87d3cbd7a50e", "sighting_of_ref": "indicator--a0a41dcb-2083-44ae-b7a3-81c391d335d0", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4449ab89-117c-4929-9b59-94beacb9b27d", "sighting_of_ref": "indicator--85becc4c-bea9-4401-a53f-be0672045c77", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d2c1ce4-ffdd-4f13-a000-91b39b70e747", "sighting_of_ref": "indicator--52a541fa-fe3c-43e7-bab0-eeb1acd7f7dc", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86e47865-583e-42ea-946e-92a60ce9afcc", "sighting_of_ref": "indicator--52a541fa-fe3c-43e7-bab0-eeb1acd7f7dc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ae7b387-56bc-4847-9d42-c7a386296406", "sighting_of_ref": "indicator--10d43822-558e-4ad2-9170-66c2a2cf0d90", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4a30496-967e-4a69-98de-ea681fd5f5ae", "sighting_of_ref": "indicator--7a96e625-a0ff-4041-ba9d-e1b89313709a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f836c93-eee8-4796-bdf7-d91f1fe90aa9", "sighting_of_ref": "indicator--02430407-4b34-4e58-926d-ca0dc4674252", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00ab32c4-0a92-4869-846e-6734b4326dc2", "sighting_of_ref": "indicator--8c6fdd56-7ddf-4971-befc-adccd0b4efd1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46248a15-ebac-47e1-817c-a2a54e0ab97c", "sighting_of_ref": "indicator--6c4da14e-4e1b-4fce-a631-5f002bae6542", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b7cefc8-a80d-48a9-953d-2e46bc110815", "sighting_of_ref": "indicator--9bb86e15-d98f-4759-a73e-9f01ce2cc29d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--efec55f2-45ca-4a87-8353-9d16c01a9889", "sighting_of_ref": "indicator--85057e5f-5edc-4c3c-819b-00b838339b6e", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--242be352-c150-4154-9290-2fa3992fa85c", "sighting_of_ref": "indicator--31d7d101-7e8b-4f45-bdaa-cfb4acdafb93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e74b0b94-c2de-44ad-b867-69342856e6e7", "sighting_of_ref": "indicator--40bd5e29-e4a7-4bdb-93d6-57d213aa6fea", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3e804b3-e22f-4ce6-904d-c659e568ec12", "sighting_of_ref": "indicator--e58a67c4-563f-43ec-8bdc-6e9eda38e54f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffb51495-0261-4795-a64e-ce2e2be52f09", "sighting_of_ref": "indicator--72d3811f-a002-4558-ad57-2ce3aa507485", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d3a55ee-42b8-4623-9f16-9fc3fddc00c8", "sighting_of_ref": "indicator--20b674b6-6ddf-48ad-84be-dd991cd9361f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d6c64de-1e28-46ac-8724-27823bbaa58f", "sighting_of_ref": "indicator--0f0d480a-f2f9-4bf0-8317-3cd2316392d9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7fab458-d1de-488b-b589-587821fbdec1", "sighting_of_ref": "indicator--c919347c-debe-4b98-b170-ee3e2e3547f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c58942cb-1e39-4390-938c-5086a8f686bd", "sighting_of_ref": "indicator--00594102-c1e0-48d7-8639-1a803e79cb15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--97b14b81-55f2-4c50-848b-f4c5a24f4583", "sighting_of_ref": "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30709969-f606-49a3-a9a1-8ae08f4d39a8", "sighting_of_ref": "indicator--cb309903-1406-4299-9b87-3f8591800ffe", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db0ab063-7b49-4bed-b8e3-0778230c609a", "sighting_of_ref": "indicator--61c7e698-0a99-4044-a4a2-14298a8e15d7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40f65416-f6a6-4eb0-9e9f-664f0c4f5dbb", "sighting_of_ref": "indicator--f778b41c-e157-4a64-9c69-534431a64a17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6c53bf6-eb81-4dd5-9509-b17cfdd34f09", "sighting_of_ref": "indicator--d8483473-d079-4c31-b79a-5588eed28a86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00a37405-f8a5-4416-af54-fc9d7d9ec4e2", "sighting_of_ref": "indicator--9ea39124-2697-4957-8906-d87138ca97c6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--703fd515-f48f-42c9-aede-36d425633687", "sighting_of_ref": "indicator--acfc7b92-d86b-4b9c-8da8-452cd3654800", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c20fcdc-5b3c-47aa-9416-de043a11f915", "sighting_of_ref": "indicator--c003dc98-fb1b-4dfa-874f-f4e4a26ec9b0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3943ab0d-f028-4d68-85e8-85ae12fdb40b", "sighting_of_ref": "indicator--f43d7178-1e90-49ac-9329-d57256bc84f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a132850-4ccc-4357-a115-fec026ba4e01", "sighting_of_ref": "indicator--ed361539-bcd3-4332-82bc-75ac1a6a6a3a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ca9ba2d-da78-4e4a-8013-ae6134d520cd", "sighting_of_ref": "indicator--61a7055b-915f-46c8-a267-48818ce2a1bf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37bf09a8-2ca3-4bdb-9a86-f25539b25b6c", "sighting_of_ref": "indicator--8da5aafd-df22-4912-80df-d354486333dd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cf37419-9b08-4647-b27b-8a99d7fae653", "sighting_of_ref": "indicator--9ebb35f3-9d68-4396-bb23-0cad236ef9a3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fff8194-5199-4ddc-a6bb-9233d35ccc21", "sighting_of_ref": "indicator--4a9f8fda-406f-47da-b643-5b84ef6529e8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--694a50a3-beb8-434a-9179-21898f431144", "sighting_of_ref": "indicator--e6bcf085-54dc-453e-abc7-9ccfa941e80c", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--974ef9f4-2715-47ef-9d82-f112e84d6fca", "sighting_of_ref": "indicator--2cfa1255-4c04-4fdd-be89-3c839e50637f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5b65cbe8-0560-4810-8126-1a4089ff2fd2", "sighting_of_ref": "indicator--65f195ba-6a37-43ff-82f1-26fe7832007d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--226436ca-13c5-4a23-90bb-b03b205424bd", "sighting_of_ref": "indicator--5817a2ee-c1fa-45ff-b011-d84d614054c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc50d5a0-65c7-4b82-9ee8-72cf298f41e1", "sighting_of_ref": "indicator--4bc805f7-7fd1-4c97-a401-285e1e605366", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80280725-6d25-4def-b971-e81a38e70790", "sighting_of_ref": "indicator--fad817b3-8440-4085-b79e-69bc6ee43a39", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e27d23fa-67e3-4275-a5a2-93fae8235df6", "sighting_of_ref": "indicator--ab9ce3ae-9e2d-45d0-ab94-54675bfc1130", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f03cdb34-e17f-4c5c-a14e-57d7d7e9c375", "sighting_of_ref": "indicator--e7d2abe8-25f5-42fe-9be4-e2674539471a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe683532-3aad-4c7b-9581-c419c85786ff", "sighting_of_ref": "indicator--c5aa6ad7-416c-4551-8d92-9b70da495277", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--256aefbf-fa00-41f7-b26f-c8aa19af70ee", "sighting_of_ref": "indicator--342ce6e6-466e-4c96-98b0-cf2f08b15a42", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce63d913-b1aa-4565-bf63-1f5c5b306fc1", "sighting_of_ref": "indicator--44964dff-ce79-4bb7-989b-a1d43127b11b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68ac718b-a484-4758-aa3f-0ea9bad23a4c", "sighting_of_ref": "indicator--8a6d3129-22ae-42dc-87fb-fe430fb31b1f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afaaecc3-d011-4c52-b468-011b00561eb7", "sighting_of_ref": "indicator--f28e64fc-be48-4bc4-b32b-615cf9fb2f06", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44959b52-d6ce-47f5-8c08-3442622c7dbe", "sighting_of_ref": "indicator--3bcccec1-db99-4176-b606-1e885063a293", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d10ececd-6040-46d1-a299-f0e728dae3e4", "sighting_of_ref": "indicator--434ba2b0-c93b-4aaa-9d55-4b4e866876eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f74eb2aa-87d7-45a0-bed9-f08b73e12907", "sighting_of_ref": "indicator--81a772d1-1268-4ae8-9a78-7c7f9cb9bed9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--839d87eb-bd54-4d8c-878e-62e87087e3a7", "sighting_of_ref": "indicator--678564d3-0ef1-4679-8278-4fe4cd24638c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26d7fbdf-9c97-4be2-ac34-0c9e7fc70a9a", "sighting_of_ref": "indicator--66c0c1bc-f75b-4ee9-a506-b1028774c5e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76b77b7f-a4cd-49e3-a6ed-36810f22a655", "sighting_of_ref": "indicator--b520d1d5-dba3-4867-9a8f-29b3bd759947", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb2dba15-a52d-48ba-ae9a-d286389cff11", "sighting_of_ref": "indicator--09b803f2-9c37-4601-8474-9a91aedd70f5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--138ec4d2-036d-4c5a-bfea-69b76d72faf0", "sighting_of_ref": "indicator--a6e88eaf-250b-43a6-b9df-4e4b567a490a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6244e3a-c9d8-4e24-84de-bb1f7788395a", "sighting_of_ref": "indicator--e1603b87-f4df-482e-838d-2f482d30fc31", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6a42c47-903c-4c8d-9941-83970192c969", "sighting_of_ref": "indicator--7f310315-6815-44de-a9bc-7095e27ddb8a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5c89ae59-a153-4e21-95e7-6ae4110eed3f", "sighting_of_ref": "indicator--855903c1-ac45-42e9-bdb6-239b9393730e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--947175d3-066a-47fc-b4a3-fd3a8da580a5", "sighting_of_ref": "indicator--33fb3e0a-4c4a-4202-9d93-3fe761ed8a10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0736856-b5ef-4cad-ac7d-2e8e02e67ead", "sighting_of_ref": "indicator--5a87082c-447b-4599-8f4d-a05fa32c5174", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70d8f18b-9af4-4ab8-bb97-ef6e55a5c83f", "sighting_of_ref": "indicator--7a45d3db-19ae-4152-a52b-596831b9c1e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6da4c8a5-b256-45ab-a49f-45947990a192", "sighting_of_ref": "indicator--50497531-fb82-4caa-9276-8821b9407fa7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ce5f5fa1-6091-4d04-99d8-0944cdf76cde", "sighting_of_ref": "indicator--07da86f9-6db5-4d37-b4b0-9dc4f8645233", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7986e120-33af-4c63-a730-b599a43405ef", "sighting_of_ref": "indicator--a89d43a3-3b85-425b-b27f-7a9cc5ead0a3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7665f070-1526-4c19-b0f9-5ffe860f7d03", "sighting_of_ref": "indicator--77f68f68-6d0e-46d3-b2f7-566f1f7fe5d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3cea4cd-822b-47d7-ab75-099b3435eabc", "sighting_of_ref": "indicator--b100af8b-2d7b-4100-be16-f3e0e34e187c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45341756-79b8-4658-bf8f-18fb13d72a77", "sighting_of_ref": "indicator--5e95041c-bfdc-4cfb-97f1-b42048a15029", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--37950b88-1f8f-447f-88ff-253559cd2d1a", "sighting_of_ref": "indicator--8b40c548-42c2-4106-b81f-ea4b32754642", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ceec36b-cf43-42c0-8f98-9963bcac51e1", "sighting_of_ref": "indicator--3daaa307-31c3-400e-912d-20d2bfbe49ab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cd56eb5-d830-4bc6-a11b-63b3e9a6d152", "sighting_of_ref": "indicator--ca634574-4bef-45c5-98af-64026f6f564c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0c595f6-523a-472d-8824-6f07d5521c0a", "sighting_of_ref": "indicator--79d957c8-eff6-4287-93ec-46b0fcf1655e", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec5e653a-af59-4776-82f9-0f7d9bc1a299", "sighting_of_ref": "indicator--80e9c055-eb44-4160-8087-b82bcdc9ba27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a70f1ba4-3017-442e-929e-9b668247ed12", "sighting_of_ref": "indicator--488c2cae-af15-4a8e-b9e8-477862157e36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aec3f6e8-5c42-463a-9fe1-be9d8f550a35", "sighting_of_ref": "indicator--0a45bed6-e969-4785-a704-568262c6674c", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22e43a64-3840-4f9a-8301-5cec15cc5694", "sighting_of_ref": "indicator--8f381559-4550-4524-8b82-443dddb49489", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5de0cb53-a5cf-4b9b-b888-1ac8aee2fa80", "sighting_of_ref": "indicator--c52d51a9-b98f-44df-82dd-b8324247896c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4732ad66-0d42-4d7f-8904-5fccfdba36cb", "sighting_of_ref": "indicator--d72eb688-f5d5-4e19-95f6-06d233247be6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--008dfe82-e433-467b-9d49-b027e317b4d3", "sighting_of_ref": "indicator--4f08fca5-4c0a-4300-ae43-7606a2140da5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25ff33aa-222e-45b0-b460-3997ffe0ac72", "sighting_of_ref": "indicator--ad672fbe-7a07-4445-a845-8e87af7a0b11", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3358f11-e6fc-4368-8d50-fd7d8991b69a", "sighting_of_ref": "indicator--651c0072-2a5e-4569-821c-c4c6bf4aa439", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a55b697-347f-4727-88e9-a51b44666e29", "sighting_of_ref": "indicator--84f7ea4c-8c68-4662-8753-aa09df2a95e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d9ae538-f7e9-4139-85f4-85d740b7fff5", "sighting_of_ref": "indicator--1c8e8ed7-b7cd-451e-bc78-2f0e0a1b5133", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c63afe8e-3ec8-4a61-9555-3d71bb8f1916", "sighting_of_ref": "indicator--e12ee5ac-9fc8-4721-846f-e23ddfbb8128", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--39d512ac-79c7-4fc3-8a82-f24f119f2d72", "sighting_of_ref": "indicator--d208aacc-6226-43a3-bdb1-ebea8e3bac2d", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71307b7f-3d02-46b6-b15a-5e0cbc20d732", "sighting_of_ref": "indicator--968c5d19-657c-43ec-965d-c03b87ebfdee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--619eaa48-9dec-4aa4-b3f3-7c2c143a1188", "sighting_of_ref": "indicator--b3e2d12d-f92d-4cad-81fa-61300c7e3784", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dcfa3256-1b31-419f-b51b-79a05b0e22be", "sighting_of_ref": "indicator--8cfcd0aa-03b5-490b-8fb5-a6a86dc9382d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72764158-149f-4953-8112-0cf41b79872c", "sighting_of_ref": "indicator--e3b1fed0-7fff-4acf-b409-b76a92e6e1de", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2dda80e4-8de7-4571-99bd-e408c6609a9b", "sighting_of_ref": "indicator--bca20d22-8fe2-4011-9b0f-02b8c1202779", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afaa7569-f991-49c1-ab30-44e2d4ce2dcf", "sighting_of_ref": "indicator--e31702f0-bd21-47b4-94f8-5cc0282ad560", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b501883b-e75e-4aa3-8299-585be781e97c", "sighting_of_ref": "indicator--5c27fd64-b4cc-45d5-a9b2-205e4ecfe99d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e14442b-55c5-4900-a6f5-08250db3c6b5", "sighting_of_ref": "indicator--8a842af2-3e15-49a4-8f4e-51d985ae995a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7999ad79-65a3-436d-94c0-58412a829f30", "sighting_of_ref": "indicator--f57e6002-84de-4742-aced-5082032dcb42", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc4f824-49bb-42f2-97ed-23725937f765", "sighting_of_ref": "indicator--42a954d2-483c-495c-b25e-584d74bb9368", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56835e7a-9a34-4941-81b5-a4e3d1404e50", "sighting_of_ref": "indicator--8dc5ab5c-7717-4058-9d72-c0946fc182c1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02bbaca8-0e2c-4031-95d2-48a126c0d485", "sighting_of_ref": "indicator--e85d371e-bc09-49d8-8da0-4f07ae6f1cdc", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7707adb-19f6-498c-a6f8-06fbc6b093ea", "sighting_of_ref": "indicator--5aff3ef0-a9e9-4c71-9965-8156627d4079", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12fd073-9ccb-4d87-af81-c6660e1c6e35", "sighting_of_ref": "indicator--5aff3ef0-a9e9-4c71-9965-8156627d4079", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8bc98bf-9709-41ad-aa99-66a90127a922", "sighting_of_ref": "indicator--fbb85987-3a6b-4fef-95a8-715c1c5f224a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b4ee395-1065-437c-b45f-1f15f4ad08f6", "sighting_of_ref": "indicator--c370c95c-32bc-456d-9ace-7c97062cdead", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc44e1e-bcea-490a-9394-66f34e72c496", "sighting_of_ref": "indicator--980da5aa-578f-4d8b-a14d-904e13daec4a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be6753e2-ac01-4ecf-9335-58be6ecbb242", "sighting_of_ref": "indicator--b2cbaee1-922a-4d9c-b707-bb9b0b90039e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--070512e2-f3f1-4d62-a9fe-95a43346361d", "sighting_of_ref": "indicator--b14640a1-d3bf-42d9-80e4-661cc921ed9c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3bbcbe9-66e2-4672-ab09-1b329e7947bb", "sighting_of_ref": "indicator--f547c1c7-68b7-45ac-a736-f34250a99583", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd8d6ef0-cad1-4c0b-aa83-ba8df70b55b2", "sighting_of_ref": "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93631f8c-b1ab-4bcb-9bbe-cb65749a9e25", "sighting_of_ref": "indicator--126db277-ae8e-4d57-9e05-cd88a3571958", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13613617-d1d4-4434-b2a2-dba3dfc657d9", "sighting_of_ref": "indicator--0f7907d2-2e93-40cb-82d2-d25649def872", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01172a30-1f2d-423e-849a-c363631797ee", "sighting_of_ref": "indicator--d1497d46-4c9d-428d-a68e-ef1fc557b4ef", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40207a0d-f5ce-4b04-a4ba-31ba7608c559", "sighting_of_ref": "indicator--3ec677c7-5f10-4e66-976b-05cebf96f874", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53812a3-23b2-413f-aa06-383f740568ea", "sighting_of_ref": "indicator--8910027a-696c-4eca-841e-730befd21f3e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0314af54-fb52-41af-955a-ec4776702062", "sighting_of_ref": "indicator--7d8f05da-397d-46da-801f-71db9939bda5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--271f87a6-8f5f-4e51-bc3f-ede6a5e92dd1", "sighting_of_ref": "indicator--23907188-4730-49db-ab90-8d2709868490", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49a61979-be09-4eac-8073-d05bf0659f81", "sighting_of_ref": "indicator--e5b4d2df-da0a-4827-99c2-73a24b5011ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b04579ff-0050-4592-9620-9742e56a224c", "sighting_of_ref": "indicator--a0764500-6e49-465f-9698-1f6ef322ce27", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01608703-aece-4b1b-b91c-baec731101c5", "sighting_of_ref": "indicator--1393d870-c9e9-46d8-8e41-12a2563876e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa04dff0-7e7d-498e-8711-1b1ca4ed773d", "sighting_of_ref": "indicator--67aca248-87a4-43d8-bfdc-728874be5f10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d847a27-e83a-4ada-82d7-0bfae9bcd97b", "sighting_of_ref": "indicator--6224fc8b-c82a-43a6-8c5f-e1b3570906d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eeffc89b-17ca-4bb0-8997-66521c483503", "sighting_of_ref": "indicator--1a7dae9f-17b5-40a4-9876-f995ea363361", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a30c975-a3e2-446e-80ed-dccf39763e3b", "sighting_of_ref": "indicator--5b8b321d-e484-4600-bf9a-d48d402311b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3d40410-46a7-4017-9508-ba426a113661", "sighting_of_ref": "indicator--657070b4-397d-4e98-b72b-705ba3b04bc9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5176d846-388d-4a03-93f9-9e2b304b1760", "sighting_of_ref": "indicator--9b207f68-3b19-49ea-b00b-a545647e4957", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38598836-7a18-47d5-af6f-ee639f43970d", "sighting_of_ref": "indicator--7b7a0a69-bb6d-4e8e-ba1a-6db670509c7e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d315fd37-ddd0-4799-94fd-44859bdeced5", "sighting_of_ref": "indicator--39c5677f-e948-44ff-8338-3c9314a1b913", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05ef155e-0571-4352-8094-5957323eff0d", "sighting_of_ref": "indicator--a54d8449-815c-4f7a-acce-4ba282af1f22", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--504cfda6-6260-44a9-8540-0ab65c2b904a", "sighting_of_ref": "indicator--5026e69d-6a37-40c3-99b7-08b62f912940", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85dd130f-ffb2-417a-9c53-f503c458e5fb", "sighting_of_ref": "indicator--27c2e316-47d0-486c-8b14-4a5c2c7ee4bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5688b125-185d-4004-8af6-95897fdb8f04", "sighting_of_ref": "indicator--16766290-9bdf-4191-8034-650fa9ead2bd", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00814cf7-0529-4c44-8c88-6d0bad8b119e", "sighting_of_ref": "indicator--ff56e529-d5da-4840-a736-5104e8fd5208", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90589d26-22ed-4422-9fe6-26edb8287afb", "sighting_of_ref": "indicator--45dfc365-9d0f-4c1f-8011-2c9b4e8b2b47", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a53dfb93-80bb-41af-a0e8-20a405120298", "sighting_of_ref": "indicator--e306a9dc-84bf-4f38-a5e4-4b73d9bb76a6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dee39ca-3aa0-4ab9-a1d2-d31ef4982083", "sighting_of_ref": "indicator--d5b040d5-2a93-4d38-903e-a7e8c3207573", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--639ec36c-8f98-4f6f-8fbe-fe3282e8c10e", "sighting_of_ref": "indicator--f18a88e8-39c7-4249-82bb-a7b5df11996e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd63bb05-1bb8-4e9a-bb67-b7027817457d", "sighting_of_ref": "indicator--461930ea-ca9b-44cc-8c58-cc804b3f6a67", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4abeca7b-7148-4730-a23d-9b4523a0a90f", "sighting_of_ref": "indicator--acaf5527-9440-4202-aad5-d531c961f4fa", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ba8f0be9-d8ef-476b-aec8-148215bfaa56", "sighting_of_ref": "indicator--63d53d55-99e1-4905-bd0a-4b30fa1b0277", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd63970a-2bcf-469e-a632-27a105e9af67", "sighting_of_ref": "indicator--e9752a97-540f-49cb-928e-bc592e4e9d51", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ce9582-6d14-4188-8393-5c46fe87dec2", "sighting_of_ref": "indicator--5bce037d-59d7-43e5-934f-d756f28195c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9d19a5e-c6a7-4a64-bdc2-dc5b59b8c7fd", "sighting_of_ref": "indicator--47fd7bfc-a441-4090-87eb-07556c4209ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a5ca2d1-e3ba-4baf-bcf6-ff2442ee1a62", "sighting_of_ref": "indicator--aa4534f5-f8bb-4b04-afbe-4528c2b0062a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f89d0ec-e9b8-4a0b-86c4-66431c39d400", "sighting_of_ref": "indicator--429717a7-ab7d-4ce6-ab12-fdf3d8fe03b1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6e51af4-bcdc-41f6-84ee-7d4001ed4f98", "sighting_of_ref": "indicator--551ac5b1-82ed-4c84-8007-bcde22f32d92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cbfe104-a6cd-4fba-b5c1-2a4d2e25629a", "sighting_of_ref": "indicator--4bf3dcf0-605f-43b6-a700-385984a7a9c1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f432fb9-b467-450b-8f0e-d2b7a3329353", "sighting_of_ref": "indicator--6599fd2c-8672-4fdc-b371-f316196adc84", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0547317f-d788-4672-a7f2-a3f9e73f2f2e", "sighting_of_ref": "indicator--69a04413-5168-4a8d-8761-79014ee34172", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03ace83e-191d-474e-a206-eaf9fa7660f2", "sighting_of_ref": "indicator--b517ff0e-c353-49ae-bddc-cac1546f57e7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef244c03-862e-4dad-bee7-e896fc63241f", "sighting_of_ref": "indicator--8c91fce9-f20f-4b34-ab24-5004320f2cde", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93743749-4a75-4a49-8d9d-6ef985aeb943", "sighting_of_ref": "indicator--665d24cb-2198-4dce-b343-dad6f5f279b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--614b0c15-a516-4ad4-87ac-ded509131e7f", "sighting_of_ref": "indicator--3de14aba-6269-475e-b6a2-59117dd799ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5be4e41-957c-4379-b2be-b8200939c4f8", "sighting_of_ref": "indicator--46b7950f-d0c7-47a7-9e0b-29f11d064dde", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--763411d1-830d-483c-ac18-d9875f4e33e2", "sighting_of_ref": "indicator--98483eaa-8e3a-4d78-9a08-6c9a76664488", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22516af6-35d8-4a39-87fd-0b4861c3fd99", "sighting_of_ref": "indicator--c208b9c5-b612-42a0-a7d0-c27ed1f74e92", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa1dc10e-d973-4ebd-9365-87d4a2d3a59c", "sighting_of_ref": "indicator--7b80a301-66aa-4c9e-8b50-26f7984fdcb8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f92230db-6862-49dd-9e75-f17e7c98c2de", "sighting_of_ref": "indicator--bf7bb648-e361-4186-a076-7b6b93a3a1c8", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b25188b-eb4d-4ecb-8cac-300fcd34eb25", "sighting_of_ref": "indicator--58333ea5-c5b8-4e20-8fba-267448d1e2d0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3e98078-4c4a-41c1-9d46-058c419e6f20", "sighting_of_ref": "indicator--bd5219bb-6c87-43a8-806c-5dbdfdaa52b8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f407511a-f396-4a45-9ae8-d9bddee8aa68", "sighting_of_ref": "indicator--8819582a-62b7-442a-8590-67482709fe50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0a2d5bc-92fc-4b38-9185-3c3ee9c0136c", "sighting_of_ref": "indicator--524fb734-c971-4324-8ef9-1e9d47e16ced", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60dda839-e299-456d-8b31-d55b3f8043f3", "sighting_of_ref": "indicator--524fb734-c971-4324-8ef9-1e9d47e16ced", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c00e609-73c1-4827-aa40-9f4d5a21e975", "sighting_of_ref": "indicator--988f5766-e8e0-4f60-b16f-9a29e2e8d45d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a51d757d-7d32-48b5-9316-4357e2ae7ddf", "sighting_of_ref": "indicator--185f4804-8670-49d8-a760-cf5fa63daa7c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bda1a9f-98d9-44c6-8837-e310efea91f7", "sighting_of_ref": "indicator--977db1a7-1767-46d9-9829-4ad45b37b4c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e90f435b-abb9-4e47-8902-5a2c9e9ae99f", "sighting_of_ref": "indicator--eaed0d98-4bb3-4a14-a1ba-7f145d2eadcd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a824ad9-136b-4640-9cef-5ac35e63c1d1", "sighting_of_ref": "indicator--2998e7cf-bcb0-422b-a20a-753d7f74125d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7484a5db-cfc8-4c04-8cfa-b99b5aade0f1", "sighting_of_ref": "indicator--31be4430-4984-4d0a-bdf2-da2cd311445d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31a71045-cb0a-4774-83f5-f04ba2bc81f4", "sighting_of_ref": "indicator--696f57e4-838b-4129-8500-a467cb53b265", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c80a501e-28db-4fe8-b77d-afb2a4ad3467", "sighting_of_ref": "indicator--50fc2034-1428-45c5-9391-904634e7c3cc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--165969f2-d960-42ed-827e-a1d885390c23", "sighting_of_ref": "indicator--406da5ba-6cf2-42b3-aea6-5d722e100e55", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9445f714-d990-42bb-8c91-e18b9fecd996", "sighting_of_ref": "indicator--4f5e81d4-ab76-4f8b-ad3f-b58fe27c4dd3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--62eb9fdc-8540-4bae-a13a-76beb95aa942", "sighting_of_ref": "indicator--4d7cff78-6331-46da-9d46-c5ff833570cf", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4590bb54-0771-4227-96ed-8b0bfb9fb114", "sighting_of_ref": "indicator--e2540a95-5917-491f-9e1f-55ddc3b79f14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f7e4e90-9194-40b8-a9ce-7dcc4fc7ab0a", "sighting_of_ref": "indicator--b46d2760-ff59-4687-b364-bc112ff6e1ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72ab115d-8a2b-498f-8b2a-42f056034c04", "sighting_of_ref": "indicator--21acc475-f47d-43b6-bc43-2dccf7abebeb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7466ca5-12d4-4b96-814f-6b2d214c1554", "sighting_of_ref": "indicator--27d5de8d-5fc7-4b3e-9647-0518359db66a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76ed9263-793a-44bb-b76a-c166e9b9334d", "sighting_of_ref": "indicator--67fb807f-0acf-40dc-a411-c38fef14330c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e77245ef-bdb2-4412-834c-58bfd26bf98f", "sighting_of_ref": "indicator--0960fd7d-2d52-4915-8d1b-d7f72c6ef12b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1eded16d-e40d-4833-9953-c2cccb2da2bf", "sighting_of_ref": "indicator--83334a29-9bb5-4089-8d19-48ebd5121e6c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e685d248-8f80-460e-bbd9-a5db931cdbec", "sighting_of_ref": "indicator--937933c8-9e48-46f7-b721-16be3e87c255", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6b0b73d-0cf9-47dd-aaaf-46a18c93e3e6", "sighting_of_ref": "indicator--e57a054b-37b5-456f-aa6a-7c96e6171c90", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42fc2e7c-c265-47c9-84f1-1932b29ab8a9", "sighting_of_ref": "indicator--94a6fee9-7497-4b15-b5b5-7158c43d06cc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6227b94a-be58-4393-b9a2-8db634e3ee5b", "sighting_of_ref": "indicator--8b19fb5a-4a85-466c-9be5-efcd4033a53e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c4a2dc9-55c9-4819-8b8f-f0c275693bbb", "sighting_of_ref": "indicator--d2d16407-4d01-47a9-909e-d29b4297b1fa", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f09638b-88c3-43ae-8741-1943bb7d826d", "sighting_of_ref": "indicator--50871110-4dfe-4ec0-8691-52949440cf9e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9c32a4d-76e6-40fd-a21b-57b3887d52ce", "sighting_of_ref": "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43473876-7aa1-465d-8ec0-d593d076ac3d", "sighting_of_ref": "indicator--826b6d4b-e331-4a04-b2d3-8de03c432133", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70c080c2-109d-46fd-8b58-f917918f0c76", "sighting_of_ref": "indicator--b6e01fbe-691c-46b3-aff4-88c728dea23a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7892291-cef3-4f95-b09d-1ec5991163c9", "sighting_of_ref": "indicator--09db3873-8b5e-4bf8-995e-395aebd4173f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0d25cd6-ea00-4d00-8de7-a965d830f4eb", "sighting_of_ref": "indicator--4471c899-bda7-4693-9e70-40fa6b469bc1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--861126a7-18f4-4859-8a2d-ef8cc79708a0", "sighting_of_ref": "indicator--6aff245e-8fd0-4c5e-99c7-14e6ef9d4907", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a010a42-7b65-4baa-a083-1259e87fbce9", "sighting_of_ref": "indicator--009a3e03-1cf9-4c5f-a3f2-73c3b5005a95", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99c18d0f-ec7f-4a05-ac03-94e3b2ca354b", "sighting_of_ref": "indicator--5e626783-2bf5-4f7f-a7e9-351ceff76437", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26f785ec-4ad5-495b-a79e-8a64c18bf99b", "sighting_of_ref": "indicator--73d66a66-0e83-4a5c-95cd-2ebd4c04a896", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--80015cc8-24c0-44f1-8b6e-5ad9c7ad91bf", "sighting_of_ref": "indicator--4fe1f7ee-3b05-4b87-b25e-723e33544969", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9fbe83d-4436-4d6a-b620-78960ae4d20f", "sighting_of_ref": "indicator--f7b9070c-500f-4c76-9eb2-c8474a5cf8ad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8bedbcb4-3270-4838-b151-819cff69e2ee", "sighting_of_ref": "indicator--38f5816f-e79d-4ada-8f39-9f756c640a14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc96cdde-d5da-4a13-a085-c6bd3cbeceaf", "sighting_of_ref": "indicator--f2e8f212-7ab4-4579-a18a-1ee7d83effad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14f98cd9-3929-4b35-b3d1-c5973035e3d2", "sighting_of_ref": "indicator--70173015-c7b6-4470-9ede-5b712aad4bd5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d8c6d7c-e6f4-4d0b-b24c-68d5eeb56844", "sighting_of_ref": "indicator--d07bf895-4245-448d-a4cb-f985d188e694", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--370c5c18-bedc-4700-89d2-82bebac5d160", "sighting_of_ref": "indicator--0f7dabed-c1fa-4dd4-82a1-b4cdb629a69b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--13cd94df-ac62-4578-89b1-ec6813b8a636", "sighting_of_ref": "indicator--4f727f23-1c17-4c5c-817b-83f66a15025c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4476584-57fd-448d-b901-be79e30e7d34", "sighting_of_ref": "indicator--7590c99e-f834-4dd1-8c83-889eb9b0ca41", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73c0a385-f33a-4ec7-b2c3-10021618189b", "sighting_of_ref": "indicator--c5c39fd2-ea23-48a3-a4ef-2a650f951f58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--516cadf0-26ca-4b9e-988d-e09eee317744", "sighting_of_ref": "indicator--c206e6c7-86a2-4f4b-872c-6970aed8c8f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38eafceb-da17-473e-aa9c-c1bf69c0995a", "sighting_of_ref": "indicator--94b7bfa6-3c30-414f-9fa2-f2ab64eb7a61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73e468c-bce9-4166-9470-5370be6de3ad", "sighting_of_ref": "indicator--84172eb3-7913-40cc-8e32-61d1467bbaa3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6e65f85-4285-4d2d-8bb0-5d093a7ba17e", "sighting_of_ref": "indicator--cacdeee8-d757-4de9-97f9-99899a8b71be", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83a11845-ac23-40af-ad58-1736dd1a97a9", "sighting_of_ref": "indicator--18b54e55-ce1c-405d-9b63-4e255521a0d1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3159401a-005d-441a-82cf-8ed61729fe1e", "sighting_of_ref": "indicator--7eb59dde-a398-4fc9-b57c-6cd81e760095", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0728579-1781-4dcc-8461-9315dc244bc4", "sighting_of_ref": "indicator--5ad77923-a3d7-4ecb-bc49-cbeb347dddb5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--72bdfffb-5f12-4b3a-b841-2ba8b9169779", "sighting_of_ref": "indicator--1cbe66b7-7e6d-4fc9-84f8-2e2b1215cb87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d90b5e40-4f3d-459a-94e2-ef4864303842", "sighting_of_ref": "indicator--a3ae951c-2274-4f32-90ed-df19d9582074", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e55435b-708b-44d7-b470-b0592ee807b8", "sighting_of_ref": "indicator--a66913cf-8ba8-43af-9527-db8f1fcc1e69", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b960213b-cc16-49b1-afb8-907248818216", "sighting_of_ref": "indicator--db472915-08de-4159-8756-64b9bc86b3f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9740707f-5ea5-4708-bfaa-3ffec9605110", "sighting_of_ref": "indicator--0d080449-e633-427d-b18a-18219cfad53b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07a31650-f893-41ee-98b1-5853b630cfb8", "sighting_of_ref": "indicator--5b5e2316-addf-4a9f-b672-309337f495c8", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca7caad-ea59-4e12-9240-dfaf6dfd02b8", "sighting_of_ref": "indicator--43e9f214-33f9-4262-985a-16dc92031e35", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ee4e1fe-251e-47f6-acfc-cae4e74a2111", "sighting_of_ref": "indicator--732de872-10ef-4140-abe3-3c16ab1a9d86", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--df558f05-f812-4552-a563-2ac436bb482c", "sighting_of_ref": "indicator--90666c3b-b049-41e0-9063-13cb4b45e1f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d63f5670-e77c-43b2-9092-2e00ac48e846", "sighting_of_ref": "indicator--90883b61-e84c-4679-900e-3a2efbb84c13", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9d025c6-5f5e-4c6a-bed1-4de776efc8a8", "sighting_of_ref": "indicator--2ceedd6d-1a46-4e71-b685-4584e2c9656c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ff30f63-9e96-42a0-9306-23d7e7e60971", "sighting_of_ref": "indicator--529157ff-30ad-4626-9d44-f2bdef1f68b5", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--055778ac-9188-43e5-804a-fb2361e5b33d", "sighting_of_ref": "indicator--dd43d4fa-df59-4fdc-ac11-f6921d80861b", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3fe1c0b-93d1-4768-97a0-13bd9bc5042b", "sighting_of_ref": "indicator--4d515786-7b9d-4244-b62f-ceb5c5b71209", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--956a4b93-fa18-4e4b-91d9-7d48f63c14cf", "sighting_of_ref": "indicator--6ae59f34-df85-4ec2-9194-e0ae2d5d5010", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb54fb87-c5e7-4a78-879d-b000d83a5ca5", "sighting_of_ref": "indicator--d55ba044-eec5-4e30-8c2a-25ce68ec92e6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d4a07c6-df4a-496c-a7a3-ec7378afb026", "sighting_of_ref": "indicator--d69818ef-99e5-487b-9230-98ae0a0d3cd5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbe881de-9825-449e-a48d-f3cd3147e12e", "sighting_of_ref": "indicator--b5810bc9-3269-4793-b43b-ec34efa48c37", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1899dbdf-4285-4de5-904c-3fc4e16bb03a", "sighting_of_ref": "indicator--6d7ccd44-4d65-4a35-b6af-3ce05371e626", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa0e672-6cc8-40c6-a4a3-dddbed90054c", "sighting_of_ref": "indicator--812c7ad6-b3ae-4183-a50d-bc71c02fc478", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9797db8-0c4a-4254-b235-f9ac095e104b", "sighting_of_ref": "indicator--82ac118e-95f1-436c-aa0a-bba96ef03e2d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f42bbcd-d0f6-4ff4-af8a-0e98f70e7dd4", "sighting_of_ref": "indicator--7285a19c-36ba-4b46-871d-1d1524492324", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad248dc7-329c-4bbd-b833-ee38c89acd8c", "sighting_of_ref": "indicator--d2a1be4b-3bbf-4e00-b4d0-a6bff8f3b4c5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ebcb9fcc-c5e8-416a-a18d-50f6b8345692", "sighting_of_ref": "indicator--04cebaf5-4dc4-4b7d-b3ae-6ef73ae14dcb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa6661f6-fbaf-496b-bdd0-9c22c65d417d", "sighting_of_ref": "indicator--c6295cec-ff0f-470c-9915-a73150b86651", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67f12565-8309-4d70-bce8-a172553ef1f4", "sighting_of_ref": "indicator--18f9475f-3b99-4f60-9683-05747b86d9a9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f43cd70-4720-4c2a-b49e-a2c84a6dfc2d", "sighting_of_ref": "indicator--9211f655-9e53-41cf-9eef-5c65a38fcade", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a966b82c-81e1-486f-ba54-9ad351d74ce9", "sighting_of_ref": "indicator--17c4c75f-594c-42aa-b292-753855fe909e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4d8e5f4-fa61-4b3d-a2bd-9d52fd53a152", "sighting_of_ref": "indicator--47c128fb-8c51-47b7-aee3-cd99373712f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--074a0805-e967-408a-bb9c-c123d8006bf7", "sighting_of_ref": "indicator--b257449f-281f-49df-8491-aa8ec891ff98", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92282216-b606-432e-8828-47c885c991d6", "sighting_of_ref": "indicator--c65342ac-3d67-47ab-836f-9c36ce41c150", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15911508-63bc-4ef4-bc3b-a04a50433564", "sighting_of_ref": "indicator--daa83822-5d9f-45f6-a800-c46993ba0b6d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a9da19e-f474-49e3-9312-6a9274877897", "sighting_of_ref": "indicator--baa4f134-729d-4a23-ae16-3a2ff1f12c46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--74fdf46d-3051-4467-9950-8c10b97ad55c", "sighting_of_ref": "indicator--3a044fa2-3443-485f-a7c3-229bb713b51b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1a3706a-4a72-478e-a14b-8d4c549813b4", "sighting_of_ref": "indicator--a5715452-ad8c-4f29-aef6-6f4fcfbee152", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--56e83306-fbc3-4202-bc9b-e33d45759ba0", "sighting_of_ref": "indicator--4fa8fd05-7e6f-4b56-ac4a-4334ff223008", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b5790d4-3377-4005-b7ba-b9b5bf661168", "sighting_of_ref": "indicator--b1af725e-aab7-4e43-82b3-a76527c75a6b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43658e31-10d9-4e6e-8be4-736de558f833", "sighting_of_ref": "indicator--f56d2c13-7abb-4187-9053-7dcddd11c6f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea103566-43c5-4075-b4c1-07355c9bff20", "sighting_of_ref": "indicator--b06a0f2e-d7ef-4cd9-a48b-eb4cd8af675d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cf47525-aa74-44fd-94f8-e36766fa026e", "sighting_of_ref": "indicator--084aed92-5f3a-4639-9e31-6d0c2d69eddf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6bc337c2-673e-4746-a3aa-4cec71b356ea", "sighting_of_ref": "indicator--68666e48-247b-4237-b497-b0990729fdc2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a28853b-a1e1-4fc5-904d-943da6cb05b4", "sighting_of_ref": "indicator--c52b430b-d4dc-46bf-b43f-d707634d380f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50ccd5ea-c0c7-49e6-9ea7-958569366a36", "sighting_of_ref": "indicator--c634b3fb-a50a-481f-8068-6d22f80e3dc7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9c4ac651-dd67-4ead-a7d4-64c98c5f62b0", "sighting_of_ref": "indicator--26917cd4-3623-43fb-9562-e7947f2c3e67", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf8fd93b-dba4-4cb6-8249-6929cbbea77d", "sighting_of_ref": "indicator--2dc0afcc-f2c3-49fb-a046-824c6e64cd3c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f019e6fe-d418-4341-8088-56f6175d5366", "sighting_of_ref": "indicator--8066290f-e85a-4631-8618-e40a55ceb898", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b322f3e4-d565-45c4-9e9b-db1c9d159706", "sighting_of_ref": "indicator--b48fa6bd-4829-419b-81a4-83c000fd6f93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ffdb739-10f9-4f74-a988-a7e06963106b", "sighting_of_ref": "indicator--7baddb64-f99f-4d3b-94c7-384e2f869d40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed84d21c-d274-42d4-b182-6462d34bfa64", "sighting_of_ref": "indicator--2d4d94bd-7104-4019-b258-720dbd429a37", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e42dcaf4-422e-4f5d-8341-9e76792b9224", "sighting_of_ref": "indicator--e7ec6fa4-9668-42d3-9f27-dd525775362e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6b35cf9-3bfd-481a-8074-91ef78419608", "sighting_of_ref": "indicator--22648ae2-9a83-4940-8e8d-f513ddeb0d46", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--05d70ac3-54e7-49c9-a49f-9d5c7bdaf2fc", "sighting_of_ref": "indicator--f62320a2-8fa1-4823-9dab-041cd0f85a22", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc84c49d-4b09-4325-9645-561975010ab9", "sighting_of_ref": "indicator--486d1c34-119b-43dd-b488-9695c94fba24", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b014df6-be0d-4abb-a844-2e5799412982", "sighting_of_ref": "indicator--8a954dd9-ea60-490c-8055-96fc4c80b60f", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55e1d858-fcb4-4d3b-b28b-07e8337faa4f", "sighting_of_ref": "indicator--8a954dd9-ea60-490c-8055-96fc4c80b60f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c522c21a-acc2-4df5-93a2-f5bbfba8ae7d", "sighting_of_ref": "indicator--3c7aef50-9a34-4f3b-95ab-1613efd8e769", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4074336-6757-4eba-8f6c-339a0b8313d0", "sighting_of_ref": "indicator--071edd58-75cd-41f2-9163-c4b389b6298a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e43323bc-0102-435b-8843-6cf8eec2b979", "sighting_of_ref": "indicator--411dd63f-eb34-4472-8e35-01e3179c9984", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1978b82-53d8-49d3-a197-fed8748b4f27", "sighting_of_ref": "indicator--2e4caeea-57e3-4520-83ff-0eaa5accb2a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96ceede4-a0d6-4f2a-a9a7-6e43b7d0c0ed", "sighting_of_ref": "indicator--07931124-c727-43bf-a2cb-46ac892ff0db", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4fc406b-44b5-4d1d-a277-d8cbb4975288", "sighting_of_ref": "indicator--72d3ed44-ba41-4b81-a4d7-28fd8a9de533", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1620dd6-21f2-49ad-bda7-01519a198a66", "sighting_of_ref": "indicator--52ae2111-d7b8-47b8-a28e-3f18256de9fb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1ec8b0e-cdba-46a3-bf72-8cea0ead94ff", "sighting_of_ref": "indicator--116b8957-8768-4da4-93e4-89a562f56e99", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03490743-c10f-4e5f-8633-74f97a75e1de", "sighting_of_ref": "indicator--8d1964c5-285b-4fed-a8db-37428283b54f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9653f1c0-6a01-460f-a096-77752a8cb843", "sighting_of_ref": "indicator--3fdb5c11-190a-4090-aac4-61b0b4bc3f27", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--742dd54d-b70f-4a26-9f3c-b481acf9b269", "sighting_of_ref": "indicator--08636220-29d3-46d1-8cdc-8f129a21f9e1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--585eda00-db37-4c43-ae94-ea0a1d688a3a", "sighting_of_ref": "indicator--425bd389-9061-443c-b5fb-1857a696e439", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8bd55a6-afa9-461b-9da6-e6ecf5843e54", "sighting_of_ref": "indicator--04680b14-6454-46e7-b8d1-8c285e7b9313", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41638398-48a5-4f0b-89ec-f61239fd1d3f", "sighting_of_ref": "indicator--a7207025-0835-466f-a7b8-2ff5c9a7dead", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b5c5cdb-d8b8-4b51-8198-9cad4c0f3c08", "sighting_of_ref": "indicator--d43ac9ac-8658-46d7-9a1e-5cd913e8bbee", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd8c7a29-9e0d-4932-8fe8-624255edaefe", "sighting_of_ref": "indicator--7bfc4f8d-a650-4eff-a238-ace121ad082a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--86420791-67d1-45d8-bdc7-6bf22df7f10d", "sighting_of_ref": "indicator--9cbf232a-ef37-43fa-8fc1-6caabce829d5", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6faefda8-b185-4962-a05d-d206175fd673", "sighting_of_ref": "indicator--36f89662-abba-4980-adf6-3875fe124622", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--528935a7-6ac5-4660-b529-79bc65e286f3", "sighting_of_ref": "indicator--3dbb140f-4e80-4ded-9488-fd486f8e34f7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ba93d28-4135-4dc1-871b-044b577c29af", "sighting_of_ref": "indicator--f106bc73-c37a-47db-b823-6048b37d9a14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a3e1acc-d405-4bfa-aab7-36a08d0475d1", "sighting_of_ref": "indicator--cef7b58a-dfd3-4a02-91bd-78ece5db9c5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d2df68c-610a-4dc3-8d78-0b8ad2a7444b", "sighting_of_ref": "indicator--7d951e32-ec8f-466d-9b8f-bcf245dfea0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--016a29cb-767a-4671-a81f-05c551541839", "sighting_of_ref": "indicator--c80ef41b-40e0-4902-99fd-5d037a9d6506", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7bc542e2-7ec4-40ad-ab8e-a8213ae7a546", "sighting_of_ref": "indicator--6d795f95-8470-4ee3-b037-3b0f35d1429d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a766ed98-569d-4eb5-ac59-3091030f97fb", "sighting_of_ref": "indicator--a4a92c75-51ed-4a80-80de-34793c6467a0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea87ebc1-d5ec-43df-9a26-1bc660038f09", "sighting_of_ref": "indicator--d7ba19b6-69cb-4b90-97d1-71d1e8051739", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8499dea0-4fc3-40db-8afb-2e3350f5f40f", "sighting_of_ref": "indicator--f2a7e472-f78b-4d13-b493-b485e8b83a17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36abdee1-043f-44a2-88aa-63e21ef043a4", "sighting_of_ref": "indicator--b4cda637-6785-4451-b47e-18eee23a8bab", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5417c79c-b71e-4643-8d79-2cf81311cc94", "sighting_of_ref": "indicator--21686ecf-29e5-49af-82e4-770e51b5d3f1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83492ba9-34f4-4fad-be2e-5be5a723539a", "sighting_of_ref": "indicator--6b316a8a-098f-4c88-bdd9-3ae5f2e30c8f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec14e8dc-fb6a-4ece-acfd-0a9a8616eb09", "sighting_of_ref": "indicator--f290b38c-a4a1-468f-b3fe-b3cd0acafa6a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d98eda4-4ac1-4090-a98e-6ee0967d6064", "sighting_of_ref": "indicator--fbef1ea6-7d58-4b66-a7d6-acd2d5f9c241", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--96198420-3521-4819-86d5-456657f87861", "sighting_of_ref": "indicator--d59ba85b-26aa-4b58-8bdc-b4aed31d151c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12083810-edec-4a56-88d1-4d6190401076", "sighting_of_ref": "indicator--260f3a81-3084-4c5e-900b-bf1baf5d6711", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b3f48fa-07d5-41ee-a30e-fef5e34267ba", "sighting_of_ref": "indicator--e2134989-a2c0-4638-ae15-b9d3dd7057dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3192890c-7f4d-400d-9d44-d56ba4d27ee4", "sighting_of_ref": "indicator--eb889dde-d061-453c-9230-589eb7eccf32", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a3d1309a-d90d-407a-8931-562a5f10d293", "sighting_of_ref": "indicator--843f3b95-5a63-4906-83bf-f147e673e299", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbc6150-9f83-4057-9184-142c16291454", "sighting_of_ref": "indicator--70ef770f-71ae-4638-b9fb-2c5b5c79f7d3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a438c1d-b574-4b3e-9fcd-36d026edfd9f", "sighting_of_ref": "indicator--b7beb7e7-967c-4192-b07d-fd779e469d15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd77711-8635-421f-900b-c9c1e42ad3e3", "sighting_of_ref": "indicator--799e3f38-b113-4861-a36b-73bd1167c9b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e1d8b08-2617-43e4-bc31-cb42a00d2b27", "sighting_of_ref": "indicator--093cad4d-df9c-477d-bdab-1677c797de15", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--04e0e28e-3159-467a-8fd5-a7250cb0fe2e", "sighting_of_ref": "indicator--1a0c0776-482b-44c8-94a0-6a61c9e27d2a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a6f789-3563-4cd3-961a-472f7d76ad1e", "sighting_of_ref": "indicator--77c2f315-8e4d-428f-a10b-1854989536af", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21e1039f-e9ec-4ad2-bb69-c68315f9c7a5", "sighting_of_ref": "indicator--356ea295-78e8-4122-902c-8c66fe42346a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9b9221b2-83ad-4dae-8d24-6b81804922af", "sighting_of_ref": "indicator--c2ed4a39-3850-401c-a9bf-a2710f362045", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad61689e-85d0-46f8-9ed9-18796c55d0b1", "sighting_of_ref": "indicator--cd812dd6-4483-4b7c-9207-bbcf16555f63", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1369b29-89bb-4a1b-81e1-e056dac1d7dd", "sighting_of_ref": "indicator--597c570e-edd8-4098-a995-2bd8c5098a14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f77a4bcd-0117-40b8-bb96-5a7863dd22d2", "sighting_of_ref": "indicator--586404df-4765-45ff-a25f-ae2861650227", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3392d01c-cd75-46b6-99e7-bd5a940f54ba", "sighting_of_ref": "indicator--7acc450d-c557-4d73-b7a6-1265f1726fb6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f6e4c5-26d5-4aa5-8660-2785e09e869f", "sighting_of_ref": "indicator--6c6b98af-062b-4caf-ac3f-bd1218cd8d66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--446a95cc-6a6f-4c5c-854c-1e4fcc5828d0", "sighting_of_ref": "indicator--3ec159ae-5007-4947-9dc3-969b103701f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e25dc9b-6108-493e-9120-18f9cfacbb8f", "sighting_of_ref": "indicator--84abb3e0-3cf2-42c5-a068-5cb98837ebeb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c212511-d213-4993-8b2f-afabb417ded3", "sighting_of_ref": "indicator--80d12be7-4cc1-4aa1-aae0-298d123ec968", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f24898b-b7b0-42e6-8fcb-afa772e06478", "sighting_of_ref": "indicator--b17668d8-aff5-4edc-867b-65cabbae1b50", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bbf3735-4325-4fcb-8eb1-cb578dae9c20", "sighting_of_ref": "indicator--a5845a0a-df54-4a3f-bfdf-39009d987cad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3cfb0951-a922-455f-9b91-5fb05098abb3", "sighting_of_ref": "indicator--398f011f-0f39-465d-bf73-9784b13cab12", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e32dc87c-2a6e-41eb-8259-14016b053bc8", "sighting_of_ref": "indicator--b485ebbf-45c4-4a03-bf46-b86e2e132dda", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f456b7bc-c5bb-4901-96ac-f77eaa060955", "sighting_of_ref": "indicator--4fd0b9ce-d1bc-4bdf-9c96-bf704046b32a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d840fd36-9400-49c5-8475-a5d484c6b97f", "sighting_of_ref": "indicator--0d726644-32c8-49aa-9217-52b57c9f1a45", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c621d3ed-3889-488e-b0c5-b27a1f76018d", "sighting_of_ref": "indicator--4021bbab-d2d7-45a2-9582-939555907662", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47803d75-5c73-4691-89bf-51d155f83794", "sighting_of_ref": "indicator--b28747a4-44db-43f0-937d-cdbf67419267", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc1e360f-a47e-4a44-9e01-805ccf20d24c", "sighting_of_ref": "indicator--a18f0585-dd3a-4fcc-9dfc-ab5f223fae59", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35910e12-dfc6-48da-a18c-a82fe6d9d223", "sighting_of_ref": "indicator--4e99b561-62ff-4029-a0b4-8a1e4656896d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c9ebc49-56f5-4059-ace5-4122d698131e", "sighting_of_ref": "indicator--509e9433-e13c-4d39-a717-c2f9f97f5957", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5676ec1a-6d54-4fb1-b49d-e32361e1b299", "sighting_of_ref": "indicator--75746bd1-2f1a-4e66-9f69-051b935110c9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ae30cf6-50b7-451d-bea5-ac4d370b4904", "sighting_of_ref": "indicator--5672748c-27e7-4c95-bbf9-306e656ffdc1", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--36fdeeee-f1f0-4769-b44f-702441c6792b", "sighting_of_ref": "indicator--8308c08d-8aea-4c7e-81f9-b59a3c6e0721", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3632ffe4-8d1c-4e27-94c8-774df54bf510", "sighting_of_ref": "indicator--ed4a92bb-eefe-4956-8d23-a52d72b67861", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b92305fe-6550-4c3b-b10b-0c0c856fa08c", "sighting_of_ref": "indicator--d1f2cc5c-383e-40f1-9794-8bfa7dd161bb", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f2235e1-1079-4a61-b9f0-5e5a271386ca", "sighting_of_ref": "indicator--d1f2cc5c-383e-40f1-9794-8bfa7dd161bb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e094c2f2-c591-4edc-bc25-891af626e75d", "sighting_of_ref": "indicator--69aeca51-eef9-424f-bb40-cec720af70a9", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ecb8810a-5d08-4be9-ab03-febc338978d2", "sighting_of_ref": "indicator--69aeca51-eef9-424f-bb40-cec720af70a9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c353bcf2-97c1-4c13-98b4-f70a122b3010", "sighting_of_ref": "indicator--769678ee-b651-4e3e-b371-1c7f795891d6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaabcb13-70c7-453f-9d21-24bf635e3d4b", "sighting_of_ref": "indicator--d4ffbb29-f6c4-4c2e-bee5-197fce65bc7a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458589a6-bdc2-4fad-a4ce-c3e490afc7e3", "sighting_of_ref": "indicator--8b4fed2d-3980-403b-b03b-0e438be215cc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5dfa732b-9120-46a5-a6d7-98f5ba892093", "sighting_of_ref": "indicator--37cce0ba-1c56-4082-a93f-875648a37dff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40e42121-65c4-4c15-9cb9-595d24e66f17", "sighting_of_ref": "indicator--e1b5deec-640b-4b28-804c-d38dd5eddfdc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b967a92-fc90-4bd7-8620-9be2de699e16", "sighting_of_ref": "indicator--5bffb3c6-2ca7-47c5-9937-7137a513c1c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--080016a6-3a2a-45cd-ae8b-4a2ab27fe90d", "sighting_of_ref": "indicator--b4f76813-0723-4162-a504-4f304d7f8f1a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--afb4f4c4-2ae3-4b5e-a0d5-a8ea3bf24ea1", "sighting_of_ref": "indicator--7a8b9c1a-e3d2-4614-80a6-0aa1b18c36fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76a63924-867e-4943-8c1d-ed22a62b8630", "sighting_of_ref": "indicator--cdfb32f4-b237-412a-97f7-601f8b562f64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0692fe1-ecc4-4b59-b08f-8bcead10411a", "sighting_of_ref": "indicator--e2056ac4-4b3f-415c-8531-35f1233a41a4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f778d2e-bf02-4d2b-85a8-6da89c7e3acf", "sighting_of_ref": "indicator--7163f7fd-f22d-4956-9193-ec1ceffd87b5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3fd78391-655e-4ec1-a96b-7da6931c1454", "sighting_of_ref": "indicator--7f23633e-e88a-4838-8aa0-e72463470b99", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8aeb5f93-299f-4757-8641-d0f42605576d", "sighting_of_ref": "indicator--1f8efa70-f499-4c1e-8c35-f082d49a95d6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3662e2b4-228c-4924-bf87-cea614f5d325", "sighting_of_ref": "indicator--84233355-a75d-4a98-9f63-3b6c91f86865", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b7f158a-49fd-47ac-a08a-0fa562e13b2d", "sighting_of_ref": "indicator--ec1ca6bb-2dcb-4dc7-9c19-e158ef44ef62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d8e35dd-1257-4491-aea1-cffbabe491ea", "sighting_of_ref": "indicator--182d00fa-bd0b-4ae3-89a6-7250e84276b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--124b9102-aaed-40ee-8561-ba95498cd9d8", "sighting_of_ref": "indicator--887d0429-a8e8-4fb8-9ff7-fd19517c7f94", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6db10013-53ad-4a08-bfaf-995ead3eaa9d", "sighting_of_ref": "indicator--369b3be1-37d1-4388-9cf8-d4b36417ce7f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68672870-c822-49ba-98a6-8e0c048fc2c3", "sighting_of_ref": "indicator--3ffc370c-b692-48a5-9156-079a1123b6cf", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae548349-ddc1-40cd-ad5c-fc705c148855", "sighting_of_ref": "indicator--686d8680-0ae2-4e79-8250-9f086c452311", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78b2e5d8-ce7c-4193-8675-0d593620162d", "sighting_of_ref": "indicator--16e37d16-7a00-46b0-ab38-72b8cab00f60", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1be2549b-2030-41cd-8aec-b7ebcb612c47", "sighting_of_ref": "indicator--c0925c93-3f39-4301-b2d7-08e2252ef7d6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0eb875e2-0ea1-4794-85d7-05ae23f789c1", "sighting_of_ref": "indicator--50729ce8-8229-4031-a523-b2f9c87f8e25", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b551350-159d-49fb-99e8-df5ba8fbda48", "sighting_of_ref": "indicator--baf99a4a-4385-459e-bbb1-b58b7c4a08e2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9af0cfbd-0f53-4fa1-839e-0ed8176f1737", "sighting_of_ref": "indicator--611c102d-8c93-41e7-a00f-25bc0ddd5d28", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4e9466f1-ac13-4e33-bfcb-d5af061132a8", "sighting_of_ref": "indicator--cd689873-a3cf-42ba-96fe-dd48cb4b874d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe998b7d-7ba7-4677-978b-593da07cc045", "sighting_of_ref": "indicator--cfc1aecb-4463-437b-82ad-bc82d941654f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9a22a98-a697-4972-8892-511631aa2756", "sighting_of_ref": "indicator--d2776772-4046-4a91-a380-12654c82d09a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e5cf915d-9d0b-45a1-87c3-659edac68064", "sighting_of_ref": "indicator--721f2807-16e2-47a8-aa1f-44ba0d1ecb9d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6de3de8c-3943-493f-b66e-e2ee589d5863", "sighting_of_ref": "indicator--0292e112-6915-45c7-bca9-efc4e1e6f182", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--08d63da6-c576-4586-afc5-6cce0b680474", "sighting_of_ref": "indicator--76afe323-30fa-4b90-b63d-420c73619d61", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3357ef48-03a1-44cc-9f9a-9fa97bc7b074", "sighting_of_ref": "indicator--fcbe4c9b-1ce6-4d76-bebc-1ef705bda4c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abd48833-5d70-41f0-991c-8d9778f98e7f", "sighting_of_ref": "indicator--c5a942b8-9f5f-4656-92ce-a121353fa3aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5121f38b-3dd5-4466-9f01-3edb770ae876", "sighting_of_ref": "indicator--19ec4e89-dda5-4f1a-a6ba-82a0e391d2e9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68eb22be-e84a-4b4e-8287-8cf6c571561f", "sighting_of_ref": "indicator--aea54850-53fa-496d-b88d-28eb305ee753", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30536aa6-e03e-498d-a272-cff8f335d0c0", "sighting_of_ref": "indicator--c534da93-c86d-47c6-be40-b7a260ff7e95", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e987d970-c4e4-4f53-ab7e-3ef8054f6b77", "sighting_of_ref": "indicator--9ac88495-543c-4e90-984e-06e889f4fee9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--810f96c6-fdcd-4224-bc9e-c818aedbf706", "sighting_of_ref": "indicator--a872e593-4d7c-4f80-9723-c5f077928cae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a67d285-f017-4d60-b682-0b2be4bfff52", "sighting_of_ref": "indicator--f2b358ac-211f-4f23-8419-e74e07db78c4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e97aee7-a84f-4cd8-9711-d74932dcf3a5", "sighting_of_ref": "indicator--eb865dda-b248-4820-98e3-98d7f816eb5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--15f4010a-8a30-4ee8-b08c-d5322ee0359c", "sighting_of_ref": "indicator--534dc469-458f-4cd4-82a0-7ff9bab168df", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2590b581-4b4b-44c1-b6cb-da9885a3867d", "sighting_of_ref": "indicator--9fb70dff-9da7-498e-9557-76d59e26d492", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b648856e-bcff-484e-8b9d-b1cef2cb8de3", "sighting_of_ref": "indicator--d2b073b0-4953-432b-b968-463b3cffde5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--763280b1-af61-4c13-8382-00a995a3f972", "sighting_of_ref": "indicator--84254c35-f752-4ccc-bd8a-cec79b32290d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69e7ada2-3692-4aec-a473-7a8b6cdbdeaa", "sighting_of_ref": "indicator--fc23236d-72cd-4823-9343-f8ef6ff23960", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ffbe0113-aaa9-411c-8a83-392ac494f11e", "sighting_of_ref": "indicator--386d3a72-ccb2-4752-bd4d-2fae4438f094", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c555a932-84ce-49a4-acb2-3371b71b6d5b", "sighting_of_ref": "indicator--90690d02-8703-4ddc-a517-72dc60c312fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c789b809-3f16-4a69-b967-15d80647f73c", "sighting_of_ref": "indicator--2fbd6489-d5e5-466b-9a54-97ca12b33203", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--417e67fe-518b-4115-977f-b7d41f911b5a", "sighting_of_ref": "indicator--1db6f4bd-1c21-46f4-829c-45a0f75a6b21", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed33febb-04b2-4cbc-8738-1f8c5c4f7b61", "sighting_of_ref": "indicator--ac856420-c77f-417e-a708-231727353737", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfccdfad-934d-45a8-8169-8198ac04d10f", "sighting_of_ref": "indicator--b0bd9736-7e6c-42b4-b32a-bb28cc4790d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb814aec-20df-4f35-b0a6-95f5be4126de", "sighting_of_ref": "indicator--fe0402eb-1ab8-423e-b9fa-7f25d22f50b8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f7b7447-35b4-40ca-a631-e737265685b8", "sighting_of_ref": "indicator--aeea3051-7011-4706-80cb-7da1fe18f08e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3a83d58f-dc9c-404d-a8c6-284b2e42294c", "sighting_of_ref": "indicator--50d2f585-3842-4d32-8168-5aad96b0a41a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c57c3dcd-275c-4211-8f1b-0ebdcafe7cea", "sighting_of_ref": "indicator--0a776d36-c4bb-49c0-a277-6b37ff61f07d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0046112-7b86-42bf-9e93-ff669877a00c", "sighting_of_ref": "indicator--288b3009-73a7-4424-aee8-b823e182502b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a2c6d0d-c7f5-4a7e-8cb1-58345ecb2071", "sighting_of_ref": "indicator--19ff8dff-b856-44e3-9f00-356ed948c2d2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0e904aef-2194-4c5c-a3b6-966271a6d243", "sighting_of_ref": "indicator--190c9398-9d2b-4aee-88bd-c8124bb2471e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45a36e6b-368a-4980-9ad5-41af9aa3b184", "sighting_of_ref": "indicator--eab291df-4b24-4ecc-8481-2ce4528e5651", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--269537d6-8d1c-46ed-bccc-d02779641dc2", "sighting_of_ref": "indicator--5b023cb6-5182-436c-927e-e94e7f2ebe14", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81e35447-b088-4635-958a-8cdb4f98fc69", "sighting_of_ref": "indicator--65bfa71d-ea89-444b-9bf5-c85cfdee08e8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1c71d56-eae9-4de2-81ea-97c04013ecff", "sighting_of_ref": "indicator--a0dd068c-352a-4dc4-9fc8-09019fdec073", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1511263e-3112-4463-bf0f-896baab481ad", "sighting_of_ref": "indicator--9e56f49d-5ce2-497a-ad14-876c59b13764", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c29745e7-c9ac-42bf-95c8-3c0c21d4f38e", "sighting_of_ref": "indicator--0bba406e-5d4f-446e-9cad-c43898f5ac17", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4475ffc5-1d83-47f8-b790-7630508d5d07", "sighting_of_ref": "indicator--f684d946-3f19-42c6-b85d-a3c5d570ffa1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f6a2c82-f6f6-4253-aa62-b968ff70915a", "sighting_of_ref": "indicator--e545845e-48c0-4ef7-ba6f-11d5a687efd4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b95fc3-ba16-4c7c-903a-b4be5b7e9efc", "sighting_of_ref": "indicator--3832eef4-ec55-46a5-9047-987f7a82a757", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be5d81df-f702-4f5a-9e4f-56091343df15", "sighting_of_ref": "indicator--ae1d8f1a-880c-4fac-aaac-d31393f808e1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2f76d51-2632-4a39-abdb-cfcadbf18859", "sighting_of_ref": "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--848e458a-4ee2-43a6-9230-ec28097996fa", "sighting_of_ref": "indicator--73c2b156-2f29-46ff-b63f-99fc5b27d11d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84715713-12f5-4713-840e-ede8dd38094c", "sighting_of_ref": "indicator--b06db96d-da92-457e-aed4-f9bb29fbd266", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e019e3d7-cbb6-4497-a50a-3e797c5ca97b", "sighting_of_ref": "indicator--d072745a-8fe2-43b2-ae26-31b10babaac6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ab511811-7177-4e83-8606-c22ca2e5e8ea", "sighting_of_ref": "indicator--023cf868-8a47-474c-9c02-257fa783f2b8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2e3abc0-c886-40a4-b887-54960cd938f2", "sighting_of_ref": "indicator--1c309ffa-6241-4809-8bb5-d6417cf28ed4", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6607195d-610f-480b-a94d-22dd7746e8bf", "sighting_of_ref": "indicator--a358c003-6737-477a-8e53-896618597747", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f1478e03-1090-4654-9a9a-3039932051ca", "sighting_of_ref": "indicator--21edc03e-54da-499f-96dc-21b93338ac0c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d21bd16e-bfa2-4aea-b312-f974abdd8e48", "sighting_of_ref": "indicator--eaa2944c-1caa-4e2d-852f-e7ba5ac30cf1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--20c0ebc6-cf5b-4f8e-beaf-6c3d6f270b44", "sighting_of_ref": "indicator--db9a610d-b6e0-46aa-a73b-fcaff56870bf", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de6e7d96-d860-4617-97ae-be7b55ea359a", "sighting_of_ref": "indicator--1254d587-f0ae-430b-844b-4b2c95b7acdf", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ade759f-e537-4d2e-90b5-777706e6dd8d", "sighting_of_ref": "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ad9604d-5f63-4aa7-8737-95abea2c1a9a", "sighting_of_ref": "indicator--c123d669-042c-4936-81df-4e14a128365d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de9af661-f917-4859-9067-48ee5fec5836", "sighting_of_ref": "indicator--d4766fd9-41c7-490d-a72d-55235eda3958", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2033af5-740d-419d-b516-c03359e0dc1e", "sighting_of_ref": "indicator--07f0c669-316a-4aa1-bb00-b95768811d93", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7313eef1-f148-4d11-a594-a83c784e05b8", "sighting_of_ref": "indicator--50b9f4be-7302-45fc-a14f-642978bf2027", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29303e63-93a6-42b9-a192-fd09b203e5e2", "sighting_of_ref": "indicator--c4c2704c-54de-4fee-a409-646140535e81", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e75f74f-f884-427b-91a2-66a6cba0bed0", "sighting_of_ref": "indicator--5f1d1544-c2b3-43cb-89d4-a6b1d5b731e3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b9d19371-c26e-4cde-b219-862ce00de936", "sighting_of_ref": "indicator--93ed3ef4-9226-44db-b876-63dbe2eb7894", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c23db0cd-7cbe-4af8-9d1b-170c5d69dfdd", "sighting_of_ref": "indicator--59b929b7-d2d1-4f05-90ce-b71c663a8237", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84b33b47-bc9f-440c-b3b8-87714045735b", "sighting_of_ref": "indicator--59b929b7-d2d1-4f05-90ce-b71c663a8237", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47461582-6e9c-4170-970e-8e70bda1ab35", "sighting_of_ref": "indicator--13ee6305-168f-4aec-b3a7-d1d933f064b9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3d416540-1277-40bb-abb0-661919183d3e", "sighting_of_ref": "indicator--6e40fecd-9f8c-4d22-bc74-fc5f88e00928", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71b16b02-e165-4844-a4be-38879cb48123", "sighting_of_ref": "indicator--87ad1cbb-5227-4d04-96a7-e74702212566", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17ac3814-a84d-40da-a339-9df639cb5324", "sighting_of_ref": "indicator--a6617dac-1c4c-4cab-9f1a-715ea5068718", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dee1bc80-a8a3-4d69-8221-f1021a649d7c", "sighting_of_ref": "indicator--3f97f9e7-8042-431b-a0a9-f8de063692f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5ecdba9c-0e12-43b2-9d26-8c3d6ffe30ad", "sighting_of_ref": "indicator--890d14e0-8d32-45cb-9c9d-b332a8e5e671", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31f441ec-e637-4576-a966-87e3c0bb2a3e", "sighting_of_ref": "indicator--6cc706c8-5ca6-4fdf-9110-c899a50a1566", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0a25e8f1-500c-43c3-a2c7-4ee65f8ec414", "sighting_of_ref": "indicator--2673a2b3-578c-4a6d-8e04-af696ecaef37", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9afd3e61-8b08-48d6-b791-e076fc0dd47e", "sighting_of_ref": "indicator--4476c976-8b74-4b2f-a801-ca3a28af9f9c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57b7936c-1149-4eba-981f-713ad4c3bc5b", "sighting_of_ref": "indicator--740ad783-fec4-42c5-a8b8-d9189cd26acc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0daa821b-533a-47ae-8d87-dff1737e1c8d", "sighting_of_ref": "indicator--b37c6376-6ca6-479f-93dd-c15f786f5086", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a784db-bef2-499b-a81d-15fc79e3421f", "sighting_of_ref": "indicator--0637a308-7a0c-4e4c-9bb7-279883a9fc95", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b859dc3c-de59-4696-ace4-c2fe692d8010", "sighting_of_ref": "indicator--6ebde14a-dadb-4d42-b6df-db056dee9979", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3287f1a-69e8-43b3-ac95-78d23246c014", "sighting_of_ref": "indicator--1bed0d7b-b04f-4d12-8af6-b563a0f5d5f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d15d0674-9704-4499-b77c-ca1a5c217567", "sighting_of_ref": "indicator--e7e7faf2-7a14-4caf-883f-7ebfd1b7918e", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee0bad0f-2691-4493-bc8a-7a2150cfb76c", "sighting_of_ref": "indicator--b78d273e-ff4a-4814-8109-d5dc39149a45", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f39c77b-abc8-4453-90c5-c83956e305a4", "sighting_of_ref": "indicator--360827d9-a1bc-496f-824c-2343004ad3ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a063a8e-caec-4dd2-a18a-86e19a932724", "sighting_of_ref": "indicator--2d5771fc-44f4-4c0a-8517-5c3cc310e48e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cb040e6-3944-4992-9b5f-ea8402ec520f", "sighting_of_ref": "indicator--42adb5ea-7539-4dc5-bad3-3c987e30a8ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91f464ed-c1a5-4ac2-88d1-bf30ad878a22", "sighting_of_ref": "indicator--dd9ec39a-a67d-4490-b37a-95006d1df557", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b392925-2610-450c-9ddb-8dd48566643f", "sighting_of_ref": "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07f6128f-9715-4bda-9dac-09edb905fbd3", "sighting_of_ref": "indicator--178cf3f6-6e42-4501-b526-7cfa46ae310c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b45b3b50-405e-4b34-9da4-b470ff6ff393", "sighting_of_ref": "indicator--1655882c-868f-4943-83bd-7372752e7288", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--44575926-1fca-4f15-8392-020be5dba172", "sighting_of_ref": "indicator--58541032-4959-476d-b82c-38ee0faf3025", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da12ac5b-9fe9-4047-bb48-928601c151a6", "sighting_of_ref": "indicator--cf1e979a-12f6-4608-8e3c-a976cc081d4a", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--46bd5bdd-66c6-4cf8-88f7-19aab9eea7ea", "sighting_of_ref": "indicator--fbfb3ffa-05f3-42b0-b94a-cadff01a7af5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70dcc56a-8e6d-42a1-a997-dee38d375168", "sighting_of_ref": "indicator--547bcc62-920b-4e28-afcd-69b33f0a244a", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0fe68cb1-14ea-43c4-9d1c-b2a053e484a2", "sighting_of_ref": "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e663f05d-2ced-41c8-a7a1-ac88294e3f5f", "sighting_of_ref": "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d530926f-06ee-46f3-90b7-e38cebc13bbf", "sighting_of_ref": "indicator--7515966b-06f2-4d81-8135-951e7889cd26", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cecc4cc-e924-470f-ab51-67d566bea63a", "sighting_of_ref": "indicator--7ce0ffe1-1d9a-48a0-8554-ab23ef31b963", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31aa026a-0ac8-46bd-8c39-e6950404efb9", "sighting_of_ref": "indicator--b8140110-e720-4eb1-9703-767b5f84d4d4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1838c642-b882-43e9-b669-f655aa8ae779", "sighting_of_ref": "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c036a5c2-eba6-42ac-a940-d170fa1d7d13", "sighting_of_ref": "indicator--7ceaff6e-7756-4f5f-a8f5-33a9b635a043", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4cc85bc2-b01e-4d3f-8919-63c53123d05c", "sighting_of_ref": "indicator--51be5e1c-9e84-4ab5-b2b1-7a04a1d5195e", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41ccc228-5a1a-4d5d-978c-64e07dd525cd", "sighting_of_ref": "indicator--68f2ee9e-197c-43d3-afd1-7e542fd51033", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8300eaf-53b2-4e2b-8867-5e65e7bdd956", "sighting_of_ref": "indicator--8a5af7b0-1616-42b5-93b8-8afad06385c3", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cff07cbf-b88c-498b-95ea-c248bd63d974", "sighting_of_ref": "indicator--8390727b-554a-4c1c-b951-5c1b7c0ffb35", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b399101d-0dac-48fc-a67b-1d6a248a63d6", "sighting_of_ref": "indicator--35aef63f-394e-4f69-8cb7-67cc9633fd43", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--87e87846-bb69-4c13-8d52-5a962f67b73e", "sighting_of_ref": "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2624666-16af-4acb-b0ea-07b1d169bec9", "sighting_of_ref": "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f68a4a03-49e5-4727-ab32-4ac74dac39f8", "sighting_of_ref": "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--667e8c73-d1a8-409b-8f5c-1b9fb4fdfb2c", "sighting_of_ref": "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac5e5cf-31bc-437a-8314-f3642158db0c", "sighting_of_ref": "indicator--f328fcd9-2521-4eae-af25-b0151bf41042", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5913147b-a0be-48c5-b2b9-7e99b0be8b34", "sighting_of_ref": "indicator--5d126d73-4a15-48f7-848e-36636b7ebf41", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d50daa-00b5-4967-8f52-eb38ea223773", "sighting_of_ref": "indicator--c17d68ff-d5ad-4340-9d28-21f8ab8d0d6a", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--be717c58-e48c-4081-9678-b97bc8de733c", "sighting_of_ref": "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef9f754b-8bc6-4aae-b790-3f81824a4ca6", "sighting_of_ref": "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae24f543-97ee-4f5e-9bd6-dda5095f93b8", "sighting_of_ref": "indicator--e1b5593f-ae26-4a03-a4c6-1138f67981a7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dca5b50f-1c84-4ec2-9dc7-ec6521c2dd7a", "sighting_of_ref": "indicator--b2770602-8163-4d16-a16d-f120200af410", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f7705f9-8a41-46cd-818d-0d11ca7cdea8", "sighting_of_ref": "indicator--1621d255-01b4-4098-8527-6bbbec9c424a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78e235d1-be7c-4017-9447-f599250eaf84", "sighting_of_ref": "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9032909c-cd9d-48cf-a10b-3df0724a1325", "sighting_of_ref": "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c44051-f4dd-4032-97bf-3e57a5bbaf42", "sighting_of_ref": "indicator--46b6ef10-b478-4ee7-ac64-e97a504189d5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fec4e09-9417-492e-ab4d-571d48d543b1", "sighting_of_ref": "indicator--f5f5db75-b1a3-4542-804a-aa51c6bd0a0d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a86e2cf3-7ae9-4b08-a564-3baf6e815759", "sighting_of_ref": "indicator--6af2ac07-2f48-43dc-8ecd-cf70d0892789", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1ad38ad0-4056-4910-8559-3f0c746d65fe", "sighting_of_ref": "indicator--9d22484c-e0dd-4545-9507-45a4009810a7", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d46fd4ae-99e1-419e-93c8-7d17f5488d09", "sighting_of_ref": "indicator--66f202be-f2e8-40d4-be62-08c588d3e6fc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--295efecc-6a31-483c-81dc-7eb2446dabd4", "sighting_of_ref": "indicator--7599deaa-d422-4c05-8c5a-fbf676596630", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--030f377c-9c60-43fe-bc75-dafd6efad312", "sighting_of_ref": "indicator--58db17c1-c2cc-4491-8da5-0098e6f44e09", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7303e78b-18d8-49fc-928d-d507756ed0de", "sighting_of_ref": "indicator--da3d9de0-86a4-4a39-aac0-f5c913fac09f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac63a91-5ace-444c-8b7d-a0a2390ea84a", "sighting_of_ref": "indicator--fdfe5627-d400-4717-b17f-61590d22446f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55a5e8a9-38f2-43df-9502-cc51db074d9d", "sighting_of_ref": "indicator--080bd13f-da31-439c-b556-5ca730c131e5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e506dc39-82a4-4f7e-80e1-d519d61341b2", "sighting_of_ref": "indicator--b9fa9e78-22e8-465d-8bc9-51f6127aea0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d971bd01-3f50-4d6d-9398-a895b9c01dfe", "sighting_of_ref": "indicator--25894873-71b3-47b3-8547-8aa1e6a9f78f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4ee8a0e8-78b0-4977-81a7-88c539c2f711", "sighting_of_ref": "indicator--507e18a0-2161-4b86-b2ff-eeacf3dcb535", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a4e014aa-04ad-4f75-9f04-f4aebb2ca382", "sighting_of_ref": "indicator--73271101-dd9a-4852-9334-c0c1404efc73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b4008ba2-4787-41d3-884a-fdf6016db4a7", "sighting_of_ref": "indicator--99faea7d-4f14-49cb-8036-9af0cfa45758", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cec17aa7-729d-4def-a0c3-fa86081ef124", "sighting_of_ref": "indicator--e658ed1c-7ab2-4e15-a55a-93318f30b5ec", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c28cf22e-39f5-485c-8a4f-e97925a96938", "sighting_of_ref": "indicator--f4d96f60-45d2-4d08-9f35-1a9376954402", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30d07d7c-0c83-4d65-8fc2-5cc2cddec378", "sighting_of_ref": "indicator--939dea73-b6fc-4574-9ba5-209905d5d593", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e088dd88-fa56-4173-858e-bf7af345b9b1", "sighting_of_ref": "indicator--3b414e38-c903-45d4-9976-514a49493bbc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23c94702-bfd3-4706-bf48-e64224632ed6", "sighting_of_ref": "indicator--23eddfd7-1fdc-44d3-9661-7f14002bf0f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c12f9162-e86d-4f87-8839-549cf9cd9ebc", "sighting_of_ref": "indicator--2597b68d-8a46-4ea1-8798-3e1b78a6efa3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9622068d-27a0-427e-86ef-d7bf15adaf2b", "sighting_of_ref": "indicator--1e0dbb32-219b-4990-9d4d-8a853f7dca34", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f599f01e-73ab-41a8-9a83-c18bf420fefa", "sighting_of_ref": "indicator--430e8804-5138-47a4-b509-8bc5bb3103fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3282a6d0-589e-4c6b-bd56-4b62b3ca5b07", "sighting_of_ref": "indicator--bf6a1660-36fd-42d7-b705-01b0a804cb09", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9334c996-df57-4af9-8c08-6915b7796a77", "sighting_of_ref": "indicator--bacab76e-ced3-48ff-b68c-22aa6a5bb461", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcd9ee8c-1e1d-45d6-8424-a1f60593fc3f", "sighting_of_ref": "indicator--8cef6713-ad93-4ddc-8094-4d183b231368", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2654792-3816-4673-aca1-4c8e8192f038", "sighting_of_ref": "indicator--54079409-30ba-420c-b985-b8d871e97459", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7f7d7a8-9d65-4a5a-ae32-2760afa11df4", "sighting_of_ref": "indicator--9b594dbd-5924-4be6-92f4-7a99621b4457", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c0bd5bd2-753b-4d57-a2b4-e9669ff19622", "sighting_of_ref": "indicator--94d2af3c-c514-40ce-9dbd-85b83bb0f29c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0836c75-bf0d-435b-9e8e-50a1a4ee3630", "sighting_of_ref": "indicator--e553dd73-7d84-4237-9481-1afaa47babfc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cfe577e3-c92c-496b-a92d-5b3b07b63623", "sighting_of_ref": "indicator--edfff737-6756-404d-9bd9-bf1e963c8ece", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d8e82f3-0b72-4f07-bdcf-81b4f75692e0", "sighting_of_ref": "indicator--229559f2-926f-451d-98b0-5f0fac7372b9", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff06e5e1-3d3a-4c0b-a52b-29f82ccdfced", "sighting_of_ref": "indicator--992d74d9-d361-42e9-9fbf-d0d8b2cd8447", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--943932bb-a4e2-446e-bf72-b5150b574fe7", "sighting_of_ref": "indicator--07b93556-87a2-43a3-ad92-e22996903482", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f9231c62-f278-4885-980d-8d3d4b1872fe", "sighting_of_ref": "indicator--ac21299b-0066-4e86-88e9-086ac7e102ef", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1ae91c4-3b67-41a8-b900-d698de044def", "sighting_of_ref": "indicator--52cec7dd-2bcb-491e-bbef-2b6b019ee711", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a1c9b90c-b52a-4313-acaf-f1115d978291", "sighting_of_ref": "indicator--028ed57b-6e04-431f-98b1-cd338eb1d2b2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a0e020a-6f1f-4dcd-95ea-2d9d312a088c", "sighting_of_ref": "indicator--8b2dec90-e9c6-4370-b252-30b684fd82f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0e29879-6f8c-4d31-adcb-2e69d61251c2", "sighting_of_ref": "indicator--d61f7ed0-f2ad-4ee2-97d8-8efa4cddc161", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95f9063f-2e96-46eb-b729-42314813f4e9", "sighting_of_ref": "indicator--ba3efea5-59d0-4038-b7fa-eff25eba7f5a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4967d7fe-a08f-4937-be32-870397e2651a", "sighting_of_ref": "indicator--12611314-e67f-4642-a163-3b8c3b88fea1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c74f8a4-293e-46fa-8cc5-9be348793986", "sighting_of_ref": "indicator--91a1ba40-605c-4c3d-97b7-2bcff97b7f1e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af1ad3f2-fc26-4e28-b01c-8303f31228db", "sighting_of_ref": "indicator--9ea17cd0-e29c-4653-94e9-ec46b6fcdd58", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42dff126-6312-46cc-952a-36e422e2da2b", "sighting_of_ref": "indicator--89b30f12-ee4f-4a2f-b37e-18222a4807ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e508bc52-f4a2-4f8e-bae9-25afba08f949", "sighting_of_ref": "indicator--b2ba8caf-a856-42dd-a8da-1d2772065dae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc0a261e-addc-4329-8e43-b58fc3316bd8", "sighting_of_ref": "indicator--b9465d33-3788-4d90-8c23-b34a8baeed7d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57b6a8da-3308-48af-bb90-85435652d459", "sighting_of_ref": "indicator--d87eb18d-d8e7-4982-9244-c90a352fef0f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--942ffa5e-d868-4e6a-8165-4b8cfd6da7a3", "sighting_of_ref": "indicator--9cb2aab6-e614-4b7a-bd8d-2dbc0716395e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da05cead-45e7-43f5-8554-f44bc996faf1", "sighting_of_ref": "indicator--ca15f936-08ed-4042-85dc-31c6027099b4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26785cb0-5735-4652-ae1f-87848fe41a63", "sighting_of_ref": "indicator--eea79de1-a916-4e2f-ba57-2ad0e67f0b07", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c071b45-c936-4f69-9ff6-d534c9e113a9", "sighting_of_ref": "indicator--35c937cf-3120-429e-9238-9b1d59be9a36", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--856a23e6-cd29-4cc5-9422-4eb1b387a493", "sighting_of_ref": "indicator--55a50086-7f7e-4511-a7ad-2b3147b4d7fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e356f3a9-20ee-4fe5-b773-3a3f80045cda", "sighting_of_ref": "indicator--71322c50-437c-415f-8ead-7121034099ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c439ea4e-e7a6-4dde-82e8-1744bf11cd52", "sighting_of_ref": "indicator--3b04be37-6616-4cc2-a036-a0c1220645dc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4a2613e-bd26-4a98-8bf1-4c207c334d08", "sighting_of_ref": "indicator--f953998d-4037-49ef-a5db-a2fe2ef45840", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9ceb825-2e0e-45c3-9e2a-e5a3331c500b", "sighting_of_ref": "indicator--b9a2b79e-8be8-4212-b58d-d4798eb2f0bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d260adf7-82ed-4083-9f97-ddb6d75f853b", "sighting_of_ref": "indicator--28530011-4878-404a-9883-20fbf853d86e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0c9a2728-e22a-409c-a8ba-3e346aa98182", "sighting_of_ref": "indicator--27f8f444-6315-44ea-9796-f72aa4311dbd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a9ecc3a-8e42-41c2-b21a-6c5aa8919334", "sighting_of_ref": "indicator--a6a15ace-0a1e-42aa-8e49-9194997ed9ea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--89b33cdf-5950-42ec-8e8f-6ef0cc4ec555", "sighting_of_ref": "indicator--917db6f2-7587-40b1-94bf-cc17dfbb7879", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43b10ab7-0562-4f79-83fe-15ad46adfe4a", "sighting_of_ref": "indicator--37681ad3-b2c8-42f8-9cff-d50172977295", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3b4d6d86-cf96-4822-92af-269ed7f1f846", "sighting_of_ref": "indicator--31218200-17ec-4dec-aaa8-6a8a5ca301c2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d74e2db-82f5-4ac5-935e-d89844065328", "sighting_of_ref": "indicator--b1a3295a-6170-4d41-971e-97489fbb6390", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--623afb52-c8df-409f-bf2b-d7acea996c33", "sighting_of_ref": "indicator--4370080f-6ef4-420f-ad8e-3d8484c87b96", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bbcf4904-5a33-4083-a807-9f690d400e38", "sighting_of_ref": "indicator--14e72ebd-2e3b-42ec-b6f2-7ec980dc95a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--021c0a2c-8263-4231-a564-31c92ed82cd1", "sighting_of_ref": "indicator--7d3fdcd5-7ed5-4b73-846a-107d6c19b7b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bbe0a36-bd63-4cf5-90b1-86c330c4dc32", "sighting_of_ref": "indicator--4b155054-4c8b-4d13-aeb6-0ae3de157dfa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc37c7e2-a82f-4694-8b65-60d8409eb6c0", "sighting_of_ref": "indicator--2aa974e0-4539-4206-915d-b1c2c5882d88", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57606422-2059-4c9c-a8f5-aed6421d55d3", "sighting_of_ref": "indicator--48a281ec-54c7-4aef-890a-7776fb8a293d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1df75a8d-6f26-4435-aa80-d65eecc5009d", "sighting_of_ref": "indicator--b248cec5-d624-45a6-89aa-2610f4e242ee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec60f605-9fcf-494a-aa12-371ed3f83970", "sighting_of_ref": "indicator--236d1810-aff9-4bae-b862-d5ce724d34f3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5f96f332-0ce0-4796-bc42-637b4924dd73", "sighting_of_ref": "indicator--56e2fa01-7c80-4ff1-9aab-77c55c8caafc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adcc2e62-cede-4050-b95c-8968ed1729b9", "sighting_of_ref": "indicator--c84cba95-d27b-437e-b128-68dbf6b05291", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85fbe39e-f0cb-4a87-8cfe-c38efa9f8cac", "sighting_of_ref": "indicator--95f7f48d-93bd-43bc-ac6c-9bfba0050bba", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e0f1e9-f98f-47c3-8a92-e3a9e49fa87f", "sighting_of_ref": "indicator--ca067eed-77bc-4243-af1c-43ac1b9ca282", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7e4717a-c731-4727-a515-cf65cbaaa53b", "sighting_of_ref": "indicator--e0cb6207-9060-4a26-8098-d3921d661a28", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--085490e5-d1ed-4a66-8291-e59e173b55be", "sighting_of_ref": "indicator--87a8ff61-26eb-4747-8809-8d57784e773d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f0cbd5-0f52-4118-9792-f57f60f88f89", "sighting_of_ref": "indicator--0f37370a-6caf-4597-a5ef-61fcb3ab8682", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8562ea6b-20dc-41e4-9d82-b57a160b4b42", "sighting_of_ref": "indicator--37e45eac-5bcc-4c19-a656-e7a6e6e8e346", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49f61dd4-f3da-4760-8ebf-c93376b24957", "sighting_of_ref": "indicator--a0cb2d30-7883-4090-915a-051db9042018", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dc7cfce-ffcf-426e-9094-ac5aa1ca2375", "sighting_of_ref": "indicator--f50896f1-5b42-41dc-865d-1f1382dd34cf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6f60c69f-bfaf-4ddc-b07a-62247101eab2", "sighting_of_ref": "indicator--33031f4d-e04b-4d01-9744-a3320174a86d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16e2d2a0-66f9-47c6-87d9-d632f018a8da", "sighting_of_ref": "indicator--690a3ef6-6364-47d9-ac25-72d36cc1645f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d9ad5cf-b276-418d-b84d-408daec2c284", "sighting_of_ref": "indicator--a6f3b4aa-3bfb-4eeb-9baf-fb60b1ab4d62", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d68baa7-17b6-4a0e-b0a5-10d4017d409b", "sighting_of_ref": "indicator--63609137-0cd4-4361-b3a6-46c1a033658d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3557bf92-5083-4379-8861-6550ec763112", "sighting_of_ref": "indicator--d55d6c88-e60e-4e1e-a35f-56d1b982e546", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a16390b8-d0f7-431e-b606-59dd860087a4", "sighting_of_ref": "indicator--514cb398-87af-4184-94ce-0090511bd2cb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--736abef2-edcc-4cd3-b1d3-be8123b3a436", "sighting_of_ref": "indicator--6d81529d-833a-4ecc-b698-c81b9b4d6823", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--77891413-0fdb-4bac-b4d9-751ca73dde31", "sighting_of_ref": "indicator--47e86290-f061-47bc-bc26-8c8d8e2e4cde", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6672f55f-74e0-47ec-a757-751e0f9223da", "sighting_of_ref": "indicator--a7efcc7c-ef61-4a4a-90c5-87d27509ae5c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55d63c68-f3fe-4319-a6f0-a9de9958c651", "sighting_of_ref": "indicator--2d21ac42-a06c-49bc-abea-5f2ad8f3ab2e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f071b27-2bc1-4e28-b47d-e947a073515b", "sighting_of_ref": "indicator--5d8e5659-a4bb-4002-b373-6ebc2ec9f761", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e8d116c6-0703-4bb0-9046-95c3af99fcb2", "sighting_of_ref": "indicator--79f2766c-41b2-4e7d-8f1f-f65174819c82", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27c626f6-dffa-4f84-89d8-bd8d0d515766", "sighting_of_ref": "indicator--133f0786-997d-48dd-95e3-f65859d22040", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e45f27bf-58f7-417f-8f5c-2fbd112d0b22", "sighting_of_ref": "indicator--bcb94c6b-4e8a-4b05-8a69-8b1a94e608a2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9d1019b-e57d-46d1-84cc-0ddd718540ff", "sighting_of_ref": "indicator--737d9344-5569-44ba-b2a9-8fe78df0529b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fea60672-86e3-4bcb-9358-82363454e037", "sighting_of_ref": "indicator--ab46f395-4a11-4d9c-8519-fc6b26c5dcbb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--560fb361-654b-4954-8058-76ca986ded95", "sighting_of_ref": "indicator--a751d77d-9dfb-4f6b-ba57-944c8b5478e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2b63c0fe-40dd-47fe-8daf-9e369ce4e159", "sighting_of_ref": "indicator--17e13469-0c42-4394-8319-696cc10d4afa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd8ef629-a0d5-4243-be3f-a9171b4df5d6", "sighting_of_ref": "indicator--5aa4745d-4fe4-4757-8b2d-b29a6f8d112a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f24914f-a64e-4975-a063-a96ef4375af6", "sighting_of_ref": "indicator--e68311a0-1148-4f23-9fd4-51b19fbed38d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f36ea711-1785-4d32-aac5-22c53942482e", "sighting_of_ref": "indicator--e3fdc94c-1d96-4cb1-9692-9b4055212cc0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bafa725d-77e1-4e2b-94a8-50392470e1de", "sighting_of_ref": "indicator--e1ed0c89-c5de-4380-9621-918b4a034d76", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6eb3bcb-1c0b-4574-afba-7685268e51d2", "sighting_of_ref": "indicator--daf417f3-6906-4acc-8f45-76a4d580dc33", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18f88ece-da59-4262-9e62-aeaf28baaf75", "sighting_of_ref": "indicator--8b3ef0d0-d63b-4105-bf78-96a78ed9f5af", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e548f80d-9a70-4ed5-9e57-896c6b5fae83", "sighting_of_ref": "indicator--669e9b08-a7ec-4a21-a27c-6ead5d2f562d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9cc86852-3b41-4aa2-867a-73c4a4500f55", "sighting_of_ref": "indicator--f1f9d689-1d93-422a-84bd-fe1e9a2bb312", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7b06d8ac-e765-40e7-9b9f-b825be4f9ca1", "sighting_of_ref": "indicator--3c571551-c1e7-4150-8333-ef38ad048f9f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c204f9f7-deb5-4e81-be26-c29de1dc84b1", "sighting_of_ref": "indicator--640ef0d7-5560-4f0b-9262-656bf37e3e1c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a00abfd-e47b-42b9-b890-bdd5b2936950", "sighting_of_ref": "indicator--1ec0e0ee-3ec9-425f-91eb-090b4b79aadc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fbd32d6-88dd-4c89-a007-0cbec8681bc4", "sighting_of_ref": "indicator--5ae3f8f0-1592-4378-93f1-8760e9d143c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--825e4c3d-c4f0-44b5-b17b-8d38cf362302", "sighting_of_ref": "indicator--275d67ad-8cd7-4b3e-a6f3-053e0473bf20", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4a6f5a5d-73a4-448e-af8e-fb94b0868507", "sighting_of_ref": "indicator--722f2940-21e6-4db7-b68a-7f597ffc90f0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a2097705-328a-46e9-9534-cb98ea7359c4", "sighting_of_ref": "indicator--f5f9128f-4fac-4d89-b13f-897bee990cad", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c88e3189-a9d2-4673-a49e-80bd2d26ae1a", "sighting_of_ref": "indicator--76985ca8-6993-49fe-931e-90680cdfe1d7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70909ac0-26ac-4d9d-a0eb-69de77f0328d", "sighting_of_ref": "indicator--2c277dad-0744-4058-9c67-b3b309dfcbf5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--320801f2-45ef-4410-a8c7-cd2c5a389dc1", "sighting_of_ref": "indicator--77893b9f-18ee-44ee-97ea-1cf629c90a35", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--480278be-3545-4105-bdb0-51827b8955a2", "sighting_of_ref": "indicator--a201fde9-75f7-4355-85a4-b8f2e920bae4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--310eead8-7377-41b0-bd07-bde757e293ce", "sighting_of_ref": "indicator--c21ab2a5-0580-4bf2-a914-d27901a5c81b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b0bb28-9b6a-4ce5-ae1a-01506c8c3a8c", "sighting_of_ref": "indicator--54920611-99a2-4d38-a1c8-108b401f7812", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8266e059-8bff-4790-997e-33e981b01e7a", "sighting_of_ref": "indicator--6da7b7c6-cbec-444e-aeac-1196771fa6b6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf88a3b2-0343-4282-b493-d809fc31513c", "sighting_of_ref": "indicator--79606229-82e9-437a-bb61-87985a2c0e0c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e57a5bcb-aab1-486c-8052-1c2c924846df", "sighting_of_ref": "indicator--9a8ba71f-63c1-406f-8ea6-363168ae0f7d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4739c361-7877-48e6-8369-1e4bd7e723f9", "sighting_of_ref": "indicator--dc86888d-3701-40ab-b706-1c80998e9d50", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2aa28da-49f9-4a29-917c-f35e083feb4d", "sighting_of_ref": "indicator--6ae09423-7b04-4016-9845-db5e2e401114", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--67b7ff38-7b42-4f53-8a58-9083f19d73a9", "sighting_of_ref": "indicator--9270ac86-7139-4e74-a20d-dd1a0b39ae38", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bba5727-28e2-4162-8a8a-617985c58086", "sighting_of_ref": "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5a2c47fc-58f2-48a3-8ad1-40ff4277ed68", "sighting_of_ref": "indicator--cfb749af-9169-4717-b73d-851a31b1542e", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5af52742-9c0c-4559-96b8-b7f16fd959f4", "sighting_of_ref": "indicator--cfb749af-9169-4717-b73d-851a31b1542e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17495fa0-5e30-4ae7-acdb-1f80e1fc85ca", "sighting_of_ref": "indicator--067f4fdc-18ea-4014-8909-5cfddabb0b7a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5df86af-8d3b-41f8-9410-cfb8cb1aaf53", "sighting_of_ref": "indicator--6b53cea0-8d17-4f91-aa2f-8cd4837d7274", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7863466-a1bd-4337-a5da-e4e129071534", "sighting_of_ref": "indicator--a132513c-8f29-496f-8d2b-ce337aa1762c", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e64cb47-f920-4671-9e9f-e5dac6a9fb40", "sighting_of_ref": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6aaa405-b064-4d7a-bc0c-1115194a8daa", "sighting_of_ref": "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--815d978e-6d14-41ed-98e5-a3f3d1f34e44", "sighting_of_ref": "indicator--4f577858-af3c-42c3-a574-bfe8d03fa5c8", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73e4b932-cc89-4e28-937a-72c09bf504d3", "sighting_of_ref": "indicator--c6328c1e-7fd8-434e-98e9-03d4b1117ddf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d967eabf-2354-429f-81fb-2042f1615353", "sighting_of_ref": "indicator--08ef5f04-a416-44c6-9ece-43cd350b8290", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--598d7c7d-d735-4d79-b3ba-194e89edf014", "sighting_of_ref": "indicator--d886b4dd-f066-43af-bbff-9615a4893829", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e79f1eb2-3ebb-42b1-b31f-c96232bd7fc9", "sighting_of_ref": "indicator--fbdfd4b9-ca06-4c92-8574-a487d847dca7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99d8b078-ba83-4af4-b680-a1d33e26df31", "sighting_of_ref": "indicator--cd314075-b975-44ab-b8aa-25880b45fe52", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dd900ab-80e6-419d-b7eb-68dcae578e8b", "sighting_of_ref": "indicator--95b2e6d9-e172-4cb0-a545-654cf5b9b7f2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--782df6f9-384a-43c1-86bb-f40a3a4e6ab6", "sighting_of_ref": "indicator--f51a41d5-40c9-4ff7-8e2a-3c08165ec917", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b53a1b6e-3830-423d-b3b1-bd35aa58a913", "sighting_of_ref": "indicator--6ed1ebd0-50d2-4308-9203-febf0466f868", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7fe519b0-4de7-41e8-bd54-ce38845cd468", "sighting_of_ref": "indicator--f0c302a3-7362-4bb5-8d43-855d8dc92c16", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8d6c07d-04d9-4005-8915-454689c27dee", "sighting_of_ref": "indicator--45fdae37-0f7d-40e6-acaa-a88a8dc49174", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--38d5366a-fb01-4a0f-9dd4-d0d691960b8e", "sighting_of_ref": "indicator--0341895b-9ffc-4894-b92e-ce17c8ac30d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c654bb77-b181-4a41-b487-cf77b261f46e", "sighting_of_ref": "indicator--57568164-d930-4c35-84d8-6ae1404f9fbf", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c663a04-2c5b-41ce-a2b4-0b37ebda923b", "sighting_of_ref": "indicator--27ad2392-2b33-4126-a529-8b772694e4fb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--16acd393-1226-4101-a9f6-6677433b2aa1", "sighting_of_ref": "indicator--2cb146f3-1584-477d-9932-b16d76fa8a53", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--12723f95-5879-4c22-b65c-7a57cbb5c31f", "sighting_of_ref": "indicator--0541c04c-8ed6-4171-81df-0117b593f728", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9135e3cd-7add-41a6-b5c2-172e11b840ec", "sighting_of_ref": "indicator--266fb56e-7df6-4c60-8348-b397d43ffc87", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8a590941-826b-4052-aece-ed833d030ef4", "sighting_of_ref": "indicator--a44fa219-f1b4-4fbf-8990-5683933cffae", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e072cd4a-2d07-45c1-8dae-3720704f0645", "sighting_of_ref": "indicator--31f4d846-fcf8-4c44-b60d-244d5c523cd2", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1217d4b-dafd-4172-ae54-7e3056c314e1", "sighting_of_ref": "indicator--042b2f03-12db-4187-bcbe-ab4864c6eda3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60230711-b29e-4d89-a90b-2cac18289962", "sighting_of_ref": "indicator--002b9082-56ea-42a7-9c0f-bdaf55157463", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07e8f0ca-385c-4045-9701-e374c7ea2e77", "sighting_of_ref": "indicator--0b3a1fbd-48db-4f81-a963-97ee605e88ec", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cedeb8f5-9cc9-4d55-a8dd-bf84467d816a", "sighting_of_ref": "indicator--70d54ea5-29ba-4ad7-b9dd-4bf4ea70f68c", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f17e321b-8120-4329-b584-df01731bb67c", "sighting_of_ref": "indicator--8db753ae-63cb-4a4d-b171-18322b315d44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d39be9f4-ab1a-4335-900c-fdeeb484665e", "sighting_of_ref": "indicator--0eebb53e-6dee-4608-877a-49616b2a9206", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea311d05-8644-4a38-af95-180f8e2ef327", "sighting_of_ref": "indicator--252ccfc3-aa55-46c4-bb73-7ba2fc1d054e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d33b37f-0ed2-4320-b907-35026f2900b9", "sighting_of_ref": "indicator--7156c2be-4da6-47ca-8fef-2f8c65e498a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--22eb621e-17df-467b-bb03-035a87b9cbdb", "sighting_of_ref": "indicator--97873e9b-7862-424d-ae3d-8769901778c9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47ee1538-225a-4c53-864f-60bab144b4b4", "sighting_of_ref": "indicator--81039d3a-0c1f-46b9-9dd6-b6f24fc5a310", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451e5e4c-6f13-4807-8982-5e03c4c5cdab", "sighting_of_ref": "indicator--8b5f3204-ac8d-4e4f-a4e1-8a709609c214", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3bc5405-6cf3-4de3-aa0e-9b01cbb80bae", "sighting_of_ref": "indicator--7b956ac5-8a31-41d0-8d0a-0dbacef6b6c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9e647c49-a00b-4558-ac2b-9a7dd3f9d4a3", "sighting_of_ref": "indicator--c584b4cc-dbed-48c8-ad53-eabae2fbb3c1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c17aa9a4-f90b-4e01-a2ed-1ff46a20287f", "sighting_of_ref": "indicator--3fe49d19-0a7f-45bc-9474-c3ad2d698b3a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--478c89e7-d71c-4cb2-8475-225e55335b22", "sighting_of_ref": "indicator--36f0f619-4635-470e-b607-b50b0c99399f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f30103-a8e1-4cfd-a5de-f536089d1bcc", "sighting_of_ref": "indicator--3e9c5915-a008-4617-8ea2-1f3628523684", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6459bade-92b5-4291-bfa3-b98c38b8513c", "sighting_of_ref": "indicator--d8f3dfd7-ac6d-4143-9d5a-a88ce41146f9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27e9238a-12aa-4834-8ea8-7af021b1a6c1", "sighting_of_ref": "indicator--f06d3086-8c5d-43e6-83fd-980511017f65", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a284e181-ae20-40ee-8c94-ad93f978aa33", "sighting_of_ref": "indicator--bf1028a7-e9f3-4d94-abf3-d75b2e56336f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d6294a1-fe73-4a37-b049-92382f23073c", "sighting_of_ref": "indicator--25dca53d-3f64-42fb-964c-a93b95430034", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f7e51f6-b987-41ae-8ccc-a87f3744fc43", "sighting_of_ref": "indicator--b3005bd6-05e3-4f22-b8d6-4b715dd74803", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0d4d4734-4f8d-48f0-a788-8225ca1879fb", "sighting_of_ref": "indicator--48a42d0d-359e-42c8-8088-c02c5d40ae2f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd6febf0-6281-43fb-8c4e-568817afcc44", "sighting_of_ref": "indicator--62301df2-896d-44d4-8df7-81f6279b2f44", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a8e3229c-da72-40ef-89ce-379795ad4646", "sighting_of_ref": "indicator--298d9329-f335-4cd3-a27b-f6a87f7e102a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c59d39a-6905-48e5-8623-73373bacb4a1", "sighting_of_ref": "indicator--84e721db-6674-4dbe-a925-eac8dd498758", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a57fa6d3-ef65-4214-b5c5-3da59469cd3d", "sighting_of_ref": "indicator--7f5c2c4e-36ac-46c8-b5fd-308be74ed348", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43f1f185-402c-4a17-8951-79475438f32f", "sighting_of_ref": "indicator--3f7ca3f6-b081-414a-a9e6-955919c2ea64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--32e75f59-46ae-4056-b6da-c489a562c6d3", "sighting_of_ref": "indicator--f7bb023e-b929-47f9-bf0d-c6ce6f945320", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fb44ded-ba46-4baf-96a8-a5bbe4b1d3dd", "sighting_of_ref": "indicator--eaa10b93-2df3-4811-a548-22915e0ad350", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6c4a9c13-2a86-4f59-84cd-5f177ed6b314", "sighting_of_ref": "indicator--848abc1c-9a12-496c-b23a-1ea6ac677bfc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6fc6728-528a-4f58-8af1-57241beb5e34", "sighting_of_ref": "indicator--b2e1a0f6-8077-4c1a-833b-c96700e979eb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--169eff80-4297-42e1-8ddd-87bff2106b9d", "sighting_of_ref": "indicator--06e042b6-9537-4a2f-bb01-e4754be4c15a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4802ca1-e579-441c-afeb-9eaa3bd3366d", "sighting_of_ref": "indicator--ef3ecf3f-e88e-437c-b290-f768b90c2811", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8680592f-2f05-46e3-b79d-f9451bf96192", "sighting_of_ref": "indicator--737098ab-c0f8-4017-8d4b-f0ac486c2454", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c55f25-1a45-4b25-a678-9e555639117e", "sighting_of_ref": "indicator--4d49f35e-d109-454d-b067-aed7acc8f083", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--99c419d7-6b19-4ace-9c80-538a3a3e7b91", "sighting_of_ref": "indicator--040689d8-7161-4108-ba4e-b9c77255e7f4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8a9a728-eec6-4e5a-b1fb-9fa95fdd5fd0", "sighting_of_ref": "indicator--3d9ff791-02e3-4e6a-9528-976ba6090775", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7578e6b5-5f21-4887-848b-909f223a604d", "sighting_of_ref": "indicator--f0151dfd-22d8-4a58-9058-b568992b30a7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3c3e7574-b3e3-4dce-ae0f-b69a0e6cf512", "sighting_of_ref": "indicator--8b86f239-2057-43c7-9c36-358b1c306e4e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2fb0de07-4c7b-403c-89f0-bcae8b60a518", "sighting_of_ref": "indicator--7c14f678-3ab3-402b-940d-4356caba3608", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--545b949b-f44b-47d1-9a3f-80b815318e97", "sighting_of_ref": "indicator--bd336f74-a5a7-4722-9c50-13a229011958", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9796fc6-a18f-4827-a3b3-a4c38d51a319", "sighting_of_ref": "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c82b538f-1d51-485d-8cfc-402f52d1888b", "sighting_of_ref": "indicator--fc6e4893-e162-4472-a812-798af1167ecf", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0155f0ae-05a5-4690-b05b-4a6f380f6a79", "sighting_of_ref": "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b2de8573-f00c-4b39-8cc1-b87db2a3588c", "sighting_of_ref": "indicator--c9d701e3-1ff2-451d-8356-29779b57f2ac", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ad40ff5b-13ae-4cc9-9518-77109db0c4f8", "sighting_of_ref": "indicator--90c4ab79-bf2b-462c-abf7-073358089362", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1c98539f-fe0f-4add-909e-b21d67ea3dfd", "sighting_of_ref": "indicator--2363fac1-38d9-4cde-87e7-06f339f72162", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7eab44b-0c3b-49fd-a45c-e315cfaf2708", "sighting_of_ref": "indicator--2b885d9e-d111-40f2-bef3-053bccaf73aa", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--21555598-d16a-426d-9b1d-cb0a48b9b863", "sighting_of_ref": "indicator--5d2dfd9b-a701-46ba-9fa8-f64dbebb3e49", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84f65d74-2f64-4dd5-a3de-d121cde49b13", "sighting_of_ref": "indicator--629f4e66-791a-41c5-b012-af89628d47d1", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--550a68bd-b6ce-489b-bfcc-e63b7ef30791", "sighting_of_ref": "indicator--451d82eb-7504-44d8-9904-6a379bec7f8f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ab6cf69-0045-42af-899c-8056affe2679", "sighting_of_ref": "indicator--004bb35c-7187-479c-95dd-6d95179fa88f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--160fde1c-a62e-4e25-b9bc-b8354fc982c5", "sighting_of_ref": "indicator--d093e952-31ad-4166-8312-987f9980d204", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a19aa8a3-7eac-4400-aa45-47795c9e3c4a", "sighting_of_ref": "indicator--9a4b26e8-0498-4379-beca-8f71b1904291", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--00d77f17-268e-464b-bc38-b86820991ace", "sighting_of_ref": "indicator--fa9e219c-91f1-4ecb-8783-b1e47ac78db0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f99458be-f3e7-4fae-a426-68712858cc13", "sighting_of_ref": "indicator--6098a23d-11ec-4c57-9980-8788f2916c57", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9fc49e04-abba-4c10-9b77-f509a2916dc4", "sighting_of_ref": "indicator--13ce7d1b-b5f6-4f67-8590-c0ce65fa9719", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52a7ee88-0bbe-49d9-b026-8f049dec39ab", "sighting_of_ref": "indicator--b5187dd2-aaa6-4c76-9a80-33a8cc27361a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b80c1731-33b2-4c0b-be1f-c3be02a6e2b2", "sighting_of_ref": "indicator--5cd5a3a5-12d5-4328-8cc3-6d11fc1f70d8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07bf2434-e787-4e33-be86-f6719cc8d97e", "sighting_of_ref": "indicator--1a76fa53-5b7c-443a-968d-54e20466c25d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ed740a1-48cb-4bfa-a0fa-15693dab1484", "sighting_of_ref": "indicator--1383927f-63b6-4ea1-9058-0451bf6f0bdd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11ebf0f-8e3a-4d74-80a0-1a3066aa5487", "sighting_of_ref": "indicator--4c941e1b-1b59-4923-bfaf-6be6298c1635", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--846d74db-2ab2-4da5-b015-1b8d4a610911", "sighting_of_ref": "indicator--817d3a55-2253-41c2-9a4a-7e8e945a0b43", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2daf0a27-8302-431b-a625-abe6be5ba6b3", "sighting_of_ref": "indicator--73de9e7d-eae5-46f5-9f26-6deb91e13b3c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2bb693ef-fc11-45f4-993b-dfa298e76fa5", "sighting_of_ref": "indicator--5390da00-feee-4a42-8ec4-0c36eb0554f4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7ed6d107-5f97-4c56-a5d2-fe90f129b803", "sighting_of_ref": "indicator--341c66c1-b4dc-4cc2-b379-22906befd00d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800c2908-b59c-4fd6-9d52-2b6a052bcc72", "sighting_of_ref": "indicator--3ea921c2-8d73-4126-9b28-db7e5d996988", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f893056-9f6a-4e75-8e58-d76cad0d8f7b", "sighting_of_ref": "indicator--a99b9010-396a-45d7-bc9b-aba0afbdd6f1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1deae2b0-0265-47fe-a379-d35293308afd", "sighting_of_ref": "indicator--7151f304-e5bd-4efb-9c03-b4d551ee5746", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b1de5180-ff48-48ee-9f9d-54f5285828f9", "sighting_of_ref": "indicator--696ede57-cf91-4800-bfa8-ed9e816bb110", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9ba2d878-e262-4707-96d4-49ad17e75573", "sighting_of_ref": "indicator--69374934-404b-4a6b-b31c-b5c1d80a9ea0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f111743f-c74b-4639-8964-ddec32fd63a8", "sighting_of_ref": "indicator--d8b01c10-79df-4bb8-9537-073d2f55940e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ed5d373d-ab6b-4e00-876e-e064b622406f", "sighting_of_ref": "indicator--86c7cec6-3213-4559-8343-8fa50edca54c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2e9cf0d-c3b0-494e-9ae4-7b29e938838e", "sighting_of_ref": "indicator--2f3d5dd0-de7e-4601-a10a-9b307623c304", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc77e709-8616-4a80-99bf-fcaa83806877", "sighting_of_ref": "indicator--6f6063cd-7861-4f22-9e87-f4a950d55a34", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--54fcc943-7142-4262-97dd-67fe73745730", "sighting_of_ref": "indicator--01b604fd-2a26-444e-8121-0391576d822c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--696a667f-7ccf-4a3b-90bc-37cf372f337d", "sighting_of_ref": "indicator--443732ef-fa6d-4e08-9ce8-5a21a94829ce", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d34257ca-de30-4096-870a-23763b00b989", "sighting_of_ref": "indicator--776371af-4451-4bc6-9bf6-20b0d2c83a17", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae2d645f-4a3e-4345-94af-212e01f7ead1", "sighting_of_ref": "indicator--b55d4017-bf2a-476b-8182-c20a632b6295", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ffb775-5d76-458a-8f66-8555b6eef688", "sighting_of_ref": "indicator--5a6674c3-489c-49dc-9069-656ce46efb1c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2f1d85c4-7cfa-41dd-9133-97d7c90cade8", "sighting_of_ref": "indicator--76f254f4-e6a3-4197-b9a6-9c693b329372", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--580f0193-1110-4130-a194-eda1a8181ed5", "sighting_of_ref": "indicator--30631815-b3c7-48e0-8431-92c783b5d68f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53f02e6c-f0a4-404c-9393-dfb616d76717", "sighting_of_ref": "indicator--371d459a-3241-4d53-bf06-778e5eff043e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6a91ea8-f703-49f6-8e19-d04d1c62a31d", "sighting_of_ref": "indicator--6ac9a356-11fe-4d3b-aae0-307e5389b059", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e22cec1-850f-4642-9b88-9b8a98f362ab", "sighting_of_ref": "indicator--aa7636e0-9f1a-4be9-970d-02ca0f2f1f0b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35b2ab97-a3e1-4cf2-b54e-fca4de9e94fc", "sighting_of_ref": "indicator--f681c5c2-0b99-439e-8f7e-505c41a02c33", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8638347-9054-450b-a945-464ced1697ed", "sighting_of_ref": "indicator--e52f60f1-16c7-43ad-a575-763d861025a4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7d184d1d-45f8-4106-af67-5ab86845fd6a", "sighting_of_ref": "indicator--7b3dd300-9bae-4b2c-b92e-112fd18ad6c8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5939ed7c-1e26-4bb5-80cc-ff768778b19a", "sighting_of_ref": "indicator--ce4660b9-5065-4c4a-9ec0-49a8a83b5cde", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a58fd772-7393-4c4b-86ba-9bb3fdedecab", "sighting_of_ref": "indicator--a5d16656-285e-4e2f-b6c8-4d85603494fd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5401df4d-2fb9-480c-90fd-9893df3bc8af", "sighting_of_ref": "indicator--8a8023dc-0d33-4975-aa2c-910652793ae1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6691e59c-1a1e-4ca2-87c2-0fdc686a4ba2", "sighting_of_ref": "indicator--53b07310-7186-4f41-8f4a-7aeb7852b44a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d171d18-5078-4017-8ef8-9e6308e31196", "sighting_of_ref": "indicator--c4ad2477-5643-4112-beb9-d49b17eaf332", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f3c7d6f-803d-46c6-934b-2b0ec7e01829", "sighting_of_ref": "indicator--73a99f06-6566-41eb-9872-8eb1c054cb99", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--52904c54-4004-41a4-8825-28dac4454296", "sighting_of_ref": "indicator--f0637a3e-519c-407c-9e3a-d2b9fb10a273", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76088df-0122-4901-8dcc-d8cabcc14f1f", "sighting_of_ref": "indicator--7d1cf65e-c7af-4799-9cd7-bb536a2384ba", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--343e9fe4-09ae-4073-bfe6-4690ef24af67", "sighting_of_ref": "indicator--7633080b-de13-46d0-9782-9bc06ac509f9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--451eafae-d105-42a7-8d11-dfcd17bf0378", "sighting_of_ref": "indicator--1cf2c2d6-8f13-4a9f-8804-43c66cfdc393", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e3412b0b-42ab-4d0d-a61b-ff7b415079b2", "sighting_of_ref": "indicator--315059c5-d8be-4721-aca1-0afdae3008b7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bb11103e-7c63-4738-a4a3-d42997c1a90e", "sighting_of_ref": "indicator--c125c929-83dd-4e9d-9380-099ef7b2bfb3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd1c47e6-3c5f-43f2-8b84-b7d1f3060239", "sighting_of_ref": "indicator--b73954ca-72e3-412b-86a7-84b0e23d9c63", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c906a6a2-cbba-4f98-936a-871c9f10ad7c", "sighting_of_ref": "indicator--ad5a4e0b-40c9-4706-9da3-d5b020eb8bf6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c78b5e7e-7ad9-4c77-b0f9-a8a562e0c45d", "sighting_of_ref": "indicator--bcfeee35-cdce-4b24-8be7-8bad97db4aab", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c97bfb5b-09fb-401e-af3c-ba547525eaa0", "sighting_of_ref": "indicator--b8677d34-a2db-43c6-b90e-c0cc31e535da", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f81371e7-799f-46f6-a60a-a612491e0943", "sighting_of_ref": "indicator--d8e1a9a0-b19d-4863-9fb8-89ac2669d6b0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b2078ea-b87a-4cc1-b102-98240bb8c5fb", "sighting_of_ref": "indicator--10acf6c0-f83f-4d2b-9568-ea683cd4dc9e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c07aa61d-6092-4da8-b989-7ad92e48afb8", "sighting_of_ref": "indicator--f04b6d8c-92e5-4fa8-bada-79d869dd532c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fbe5cd16-fe62-41a0-8a32-be71b2e7f696", "sighting_of_ref": "indicator--5c96a6b9-732a-4f91-a8b4-ab9f95dae21c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1380067e-4032-4f5c-9dd2-26ff199bb872", "sighting_of_ref": "indicator--ffb54b12-2910-4678-9e94-e7ebba2e198d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--befebe5b-5733-4bd0-9b6e-b8ea45e0db2e", "sighting_of_ref": "indicator--252cc3eb-3a40-4b26-8bf9-4bb33d093995", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--11fe143a-6a7d-4e6e-8e90-fbdfd84f4394", "sighting_of_ref": "indicator--bc973496-bed5-4930-b3de-a81d7ce9b4bb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f75c52eb-a81d-47a2-aa4c-b9f3e026d71e", "sighting_of_ref": "indicator--5eacff47-236b-4580-a374-e58e337cf108", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--73f74c83-91c2-40cc-ab94-3c9d201d970e", "sighting_of_ref": "indicator--c4141428-7280-4ded-a94e-f52e52ef2fc9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c390dad5-f2ed-4945-8ba4-9b07645d1a56", "sighting_of_ref": "indicator--513ab47b-8be6-431a-b53d-65d1334806d1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--087432cc-83ed-4b9c-9daa-488660d37b8d", "sighting_of_ref": "indicator--5acfc6ef-73d6-4ec3-8717-f3e325f487aa", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adff356a-4c72-401b-834b-8cc27b78ef40", "sighting_of_ref": "indicator--bbf39466-1b1e-4dbd-8362-c58d5242a53f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--797203f7-5d4d-4cd9-9a03-ed5c7d1cc52e", "sighting_of_ref": "indicator--82f54565-ab72-4795-9c68-2f44f5343832", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1b9399c2-5e2b-477b-9213-2f59f52457a7", "sighting_of_ref": "indicator--c510812e-1633-4f55-a4de-3613daf0e781", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f50f0f6-15b4-4ac3-93a1-be3e2e8b16b9", "sighting_of_ref": "indicator--aa34af50-75a7-40d1-93c8-ee4eee713774", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5abe5bf-01d6-4fb0-852b-1985de8255d0", "sighting_of_ref": "indicator--e9cfb976-a26b-4488-b67f-1a56a8c012bc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1cb81ec-b4d1-4908-8035-dc6c2959975b", "sighting_of_ref": "indicator--f2ece4a0-592f-407d-814f-92c1e54c1481", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--395e941b-7b19-4006-8a92-face1919e97a", "sighting_of_ref": "indicator--54e1cd3c-785a-4f79-92bd-5fb14b6d3d5a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f0392473-5227-4905-955b-5ea94f750974", "sighting_of_ref": "indicator--278a3f7f-0b5c-4283-8137-db049b38d26b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a5ccc4b3-731b-4408-aed4-b917421fe7f2", "sighting_of_ref": "indicator--3d1777de-73a8-47c0-8918-466d78e27bd9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--760a72f1-ce76-40d3-8878-144c38f923ed", "sighting_of_ref": "indicator--0ff02e1b-858c-4f89-acec-c8d4c28820e4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98ad3ce2-b276-43b1-b7ee-78ce7c8b6c53", "sighting_of_ref": "indicator--39d6cd70-6cd3-484a-8592-cbc1df16a8c1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9957640-1fc0-40e0-ae8d-0bf02abba08e", "sighting_of_ref": "indicator--0761ab1f-804e-4737-bea0-c02706925a0e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2a09504-168d-4780-826f-69a1cd83f196", "sighting_of_ref": "indicator--ed753517-65fb-4382-9750-6115aa24a12f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea471500-503d-4752-bc0e-fed2e76db05f", "sighting_of_ref": "indicator--b0fdfdae-b5d6-4548-9fec-d92fec311f07", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18b0b31b-9723-45eb-839f-69bb55f47b10", "sighting_of_ref": "indicator--d27f2325-a7a1-4ca7-b92e-ed4c0962c35d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59a315d8-592a-484a-be99-46fc75937e84", "sighting_of_ref": "indicator--fc47b3a1-912b-4936-ae7d-6003694b7bff", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d55b812-df98-4534-8506-ffbe64442a09", "sighting_of_ref": "indicator--adf3671f-db70-4698-8f57-b8fb06eacbe1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26974671-17c4-4cb4-907a-37c1e211ca8a", "sighting_of_ref": "indicator--a498593b-7b97-4d12-88aa-499f9a122ca4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28770a88-9c8d-413f-b9da-1a4784d79fab", "sighting_of_ref": "indicator--3a68ead8-54eb-490e-a95d-91542cd0a304", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4192e86d-4f27-4780-b8ee-29327cb5bb2b", "sighting_of_ref": "indicator--0f272ba4-3075-4ca2-b72c-9473953bab3b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5bb8bb0a-40c5-4013-aa95-bb2735ecb26c", "sighting_of_ref": "indicator--51bc64bd-b0f3-4466-bd21-b43e8a022c72", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf72b3ca-5e8d-4a33-ac5e-51e94024f829", "sighting_of_ref": "indicator--2b645bc7-0674-4432-88b4-3ac2c121c465", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f69475d-fce1-4ff8-b149-d2ef4cf2e871", "sighting_of_ref": "indicator--6e25f00a-e626-489d-ba78-26e53af752b9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95a2e6bf-2b5c-4240-b572-795a3697bcba", "sighting_of_ref": "indicator--2b1402e7-3977-4db2-a599-a62d15b22668", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4dd2097b-b8ac-4ed3-afdd-c5b88a17de91", "sighting_of_ref": "indicator--f7cd2500-91cc-4d7f-899a-5b4bc7ee5350", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3a15473-0f04-4682-bfc0-f27a15353f70", "sighting_of_ref": "indicator--5f8bdaca-34e9-4331-b098-42a1f1c6ec91", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--49cce288-23ae-4aa8-87c2-18019cc6db24", "sighting_of_ref": "indicator--f680e1d1-1088-4bb8-8210-dbb3795971cd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e084481e-4ff8-48db-a84b-37cd80e9b5e8", "sighting_of_ref": "indicator--427885bb-7741-43da-ad12-3f3a6bbc05a4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7a8990d-e94f-47c8-9256-e6bdaf24ab03", "sighting_of_ref": "indicator--1b383604-0733-4c74-86c3-9b07ff3053a0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4861665a-0ac2-4d6a-8710-a571e63a3470", "sighting_of_ref": "indicator--8764d6bf-06d7-4a85-bdf2-bee533187c12", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7b54258-c43c-4ebb-8825-27842221ad9c", "sighting_of_ref": "indicator--091772d1-e3aa-44b8-9f06-52673ccbf0e7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c7352c50-67ad-4089-90da-0a832275e81e", "sighting_of_ref": "indicator--a793d0be-e49c-44cb-b037-b467f2063dce", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8e5c5d5b-e4c9-489b-a402-3a8da93dbf21", "sighting_of_ref": "indicator--32268e56-fd7f-4a0f-b48a-a8193d6d0dad", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--044a0c5a-5fb9-4a89-a2e8-fba1578d8dac", "sighting_of_ref": "indicator--59c36667-e898-4527-a230-52f034d00853", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f7bd9976-47a4-4c88-b7e3-b77294f28a5e", "sighting_of_ref": "indicator--ab9c022a-ec70-4ed7-9f8d-90c54747a8a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ee82dc03-9d5d-4f5b-98a5-c98ada66f73f", "sighting_of_ref": "indicator--bc865eb8-d46b-46b6-b590-111788955c4a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6ee0708a-8633-4729-a65a-335c1d53d10c", "sighting_of_ref": "indicator--2520fb85-4efc-4384-a0f4-90d9e64af0bb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f3ab62a-409b-4d0e-8269-f73debcb23df", "sighting_of_ref": "indicator--87bcbd7e-0f60-446d-ae8d-a1598973b122", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--abc11995-bfe0-4d78-8b93-e60737ccd03e", "sighting_of_ref": "indicator--a2f61f5d-270c-4bde-b17a-a045845a6428", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7807598-2e31-47fb-b659-ad5e94c0f40a", "sighting_of_ref": "indicator--08bf1466-8e62-400d-b62f-3aac88277aa0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55875f41-1688-4d3e-898e-fa13d646050c", "sighting_of_ref": "indicator--08859bce-b286-44a4-a4ff-bdf611b57f70", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8496897a-4868-47b7-8508-47bb99da5ae2", "sighting_of_ref": "indicator--8a41a1d3-5e2c-4a5d-8c5c-c4cfb871ecfa", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2993e57c-f800-4606-97f9-adaa2207e719", "sighting_of_ref": "indicator--08a069f3-a80e-49ac-87d5-6387557d5f58", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--af02be46-5a74-4b31-bcee-38658f1db587", "sighting_of_ref": "indicator--582c97a9-473d-427f-8298-d4f6bf4564c6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e2b27102-2859-4fb4-9a39-c6e5bc4d9612", "sighting_of_ref": "indicator--8be2b5c1-ca55-4fb1-b936-d1832a0eebfb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--27063396-7f41-48c1-b505-6dc931e492e5", "sighting_of_ref": "indicator--4b46a09d-6d1b-4241-bd8b-006b7880bb88", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14d11496-425f-459e-a02c-68e7fca4d806", "sighting_of_ref": "indicator--66b9e881-cf8e-4b81-b991-ef99660678f0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d1d14cb0-2afc-484f-99c8-9ec789c286ba", "sighting_of_ref": "indicator--4db82d05-224a-4d02-9f14-a1d25442f861", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d3a28048-f00b-437a-9e33-4fbe6a037c3a", "sighting_of_ref": "indicator--1cf9bedb-687c-4406-a29c-fbead3f5d8bc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d5c17770-34c3-4ed7-9c02-ef9023ca2c8f", "sighting_of_ref": "indicator--cfc63dff-f330-4a3e-b5dc-ea160438471f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--68302f5b-f0f2-448a-a320-b273afb5c473", "sighting_of_ref": "indicator--e4d2a04f-d717-4655-ab1e-a3bc1d01c16c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa1acb7d-a235-4c74-bad6-eabff320cc51", "sighting_of_ref": "indicator--2caf6bc1-ed3f-4503-863f-9acf0f13c60e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--30e42a89-63e7-469e-a300-065cc398b5d1", "sighting_of_ref": "indicator--3ceef5af-a8e9-4461-a0f8-2a1b78378604", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7efc0f0a-e54d-45c3-99ab-2123a234c46a", "sighting_of_ref": "indicator--93968509-3197-441b-87c2-30f7d74059ee", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18d929a5-10c3-467a-b75e-b77ceef43659", "sighting_of_ref": "indicator--cee9c4fb-7279-47da-8617-0e82ee1d799c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a585784b-2280-4cdb-bc2d-765984099ec8", "sighting_of_ref": "indicator--69c2050b-f7d0-4b7e-bc6c-7d7907d845a5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f91fe60b-3436-4037-8a62-f0a1341e7dfd", "sighting_of_ref": "indicator--1f4d69e6-0b87-47ce-affd-bee5e91bd913", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d4b6718a-10cf-430c-987f-8ba8abec7e35", "sighting_of_ref": "indicator--76c107d7-2c9e-4dc9-a6ea-504b68d05dfe", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8223fc97-c203-4d46-b38d-bd2bc38d9b67", "sighting_of_ref": "indicator--f1c8f4db-0a9e-4119-9002-c13d4c2d166a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfd63c97-d4ce-40bf-8370-3fb6a6a4f56b", "sighting_of_ref": "indicator--25fcd1c1-464d-466b-9482-4f4f94e0b87c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e71db02-78d9-4028-9e3b-7c6baa4cf53f", "sighting_of_ref": "indicator--613ade95-2628-49f7-921e-75444ba35d60", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b709a15-c3c3-4499-844b-03238f3e862e", "sighting_of_ref": "indicator--ef50475b-ca11-466b-8d64-ad238d27f630", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eaa7495d-9f3e-41f1-9ab9-6b9dd172573d", "sighting_of_ref": "indicator--92d04a09-159a-490c-a93b-79697f8ea5de", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0adf9a9e-dcd6-4a12-8a63-1e91a98251c2", "sighting_of_ref": "indicator--4415b5d5-cc02-4685-a7db-f82e849f0512", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cd036c97-7850-4e52-8af5-1ed5008510b0", "sighting_of_ref": "indicator--4448ab55-c118-4f3c-9457-2c00ff076141", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ec308cc8-34f6-45cc-aa08-6fad7a709211", "sighting_of_ref": "indicator--09acaca4-52e4-4f70-88eb-eed38043d921", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--099af353-e384-40dc-8444-7098a782ec06", "sighting_of_ref": "indicator--26fa9b4c-6bb0-4b65-b36b-8865c4ebf1a9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--70e689ae-aaad-4e34-95be-ae78f54ed707", "sighting_of_ref": "indicator--4ac3eae2-aa5f-4d70-8ca5-874bc9d0a799", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bc37af1-9b59-4408-a3d2-a264e2f4313b", "sighting_of_ref": "indicator--66800a86-a653-47ed-8aba-89e05db8bc1a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b425ff60-7603-4857-9816-d68a827e5cb4", "sighting_of_ref": "indicator--418e5d5d-b0ff-467d-a11b-dcf5fa68921b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb8bb69a-e4bf-4385-add4-adb252699203", "sighting_of_ref": "indicator--6352ebad-106d-4ef8-a23b-333f6791021e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03e98c69-74dd-4de3-80b3-67ca49ac534d", "sighting_of_ref": "indicator--434b2e48-cd1d-46dd-ad74-4a7a8230b012", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f748df4e-03f9-4cdb-bde9-192b2ad7dbed", "sighting_of_ref": "indicator--9d4482b9-5571-4da1-b5c6-7a9878d57eec", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3115d05c-63da-40be-9ac5-d9c4087df2e3", "sighting_of_ref": "indicator--7bcccd12-79b4-4d13-901e-b8a90761f74f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fe24cfcb-16b6-46b5-bb38-a91bcd1e71b1", "sighting_of_ref": "indicator--d3a1624d-d0ae-46ed-b606-2786d204b227", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--697156fa-de6b-45b3-9d67-6c589f402f54", "sighting_of_ref": "indicator--ff767d4e-44c9-44dc-9599-6633e80b7781", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--993546f3-95f5-4836-8095-8ee6da6e411c", "sighting_of_ref": "indicator--b11e9da6-a4a0-416a-b74e-28f2877fb3d0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--18aaa515-de77-4882-8929-2852591e57e0", "sighting_of_ref": "indicator--4579844d-e506-4acf-a054-2bc0308aa7b3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--07b50420-f872-4667-a5c3-ffcced322d39", "sighting_of_ref": "indicator--d212f8de-5f6f-4449-b526-2751e2f5f95e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dac46870-68a0-4727-867e-57f30ea28335", "sighting_of_ref": "indicator--4980d57c-1dda-4c7e-9a87-2ba7af0f9134", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2cce19-41e4-4b69-b35a-a439bb74c2c1", "sighting_of_ref": "indicator--f32c9623-774d-4832-97f5-27c8cef1b46c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ed95ddd-1fab-4606-a7cd-caf32462d45b", "sighting_of_ref": "indicator--fc81293f-50aa-47e3-9b9c-20fe5a7b2316", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4066f3b9-51fb-479d-a4f1-b149f20c6255", "sighting_of_ref": "indicator--c7438b7e-1c91-4000-b12d-125608e7f2a8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9901de58-a367-4a60-bf00-c537047e0654", "sighting_of_ref": "indicator--47410eb8-b48b-496d-98e7-f58a57668ba6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--404443bf-29ab-441e-9c86-f61ee66e21f0", "sighting_of_ref": "indicator--f3d22c87-e50b-487e-ad79-610349d2b61f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c4e3d425-6cb1-4025-b034-3f90f8fcc942", "sighting_of_ref": "indicator--6aff369c-c62c-4c32-b70d-8ac108959d8d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81f919c0-5699-4c4f-b475-2b7a35ee7547", "sighting_of_ref": "indicator--9254e366-6f8f-45ac-ab64-a446222f658e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24824b54-d32b-4ff9-a8b6-4dc6b2c8023c", "sighting_of_ref": "indicator--3da2dd63-dddc-4af5-8e8e-72435d861a28", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bf156b76-933e-4b31-b849-7f2c74aa3349", "sighting_of_ref": "indicator--3f70a762-9201-4151-b68d-0602104a6d98", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e0f7143e-5773-44fa-9789-4488a8c9d2b9", "sighting_of_ref": "indicator--e0938750-11bf-4320-ab05-83ae66b1d5c3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dca5653-f075-427e-99c8-50a390122f68", "sighting_of_ref": "indicator--2aef8992-e6ec-45b0-8242-18f528397d29", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59673c7a-7221-45f5-9a6c-3d70659bdcae", "sighting_of_ref": "indicator--7592288d-6836-4949-a008-fbbfe2ff4f28", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d74b2409-255e-40e6-875f-c7b178495fac", "sighting_of_ref": "indicator--a97bfdc5-a2d3-46cb-bb49-3206ac6e68df", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6f9c4b2-fdbc-4b60-b0c1-644909d515fe", "sighting_of_ref": "indicator--1e67fb28-9557-44d4-8fb0-358ac86ff9f5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d728524e-6dae-4381-bf3a-d153bc925871", "sighting_of_ref": "indicator--c9145af1-51b9-44b0-b6b4-10b30056705e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0f9ca8c2-afb0-4398-9768-452eafee10ef", "sighting_of_ref": "indicator--c71305e1-422f-4e4d-8c69-cb0e8c876eb4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cfafb28-24d3-4359-bd29-51593b04c69c", "sighting_of_ref": "indicator--09f3d16a-fd18-41dc-9a3e-cda4b3bd64b6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bed22667-3b72-4852-9e21-930c82885352", "sighting_of_ref": "indicator--a95ba8e6-f56d-441c-bb9d-ae610dc232ce", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--970003cf-7fd1-439d-badd-7f8ff68dedd4", "sighting_of_ref": "indicator--3590e111-eb5f-4433-833f-20cfb87a1d75", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cbd8978-56b1-4a11-b4fe-b1738a5d1408", "sighting_of_ref": "indicator--c396f5a1-aaf7-4bff-a735-cad33d86053f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2562aa68-8cb0-44ca-b8e4-4912e93aec34", "sighting_of_ref": "indicator--259a82a3-c9b1-48e7-97ad-b08fe60ed44f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84714fa4-c958-4f70-ac77-a4fc9f23f6e7", "sighting_of_ref": "indicator--bef2ce4c-5b2e-4043-b856-5b84f748c634", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3ff067e8-0350-465e-a370-d6739f152fcf", "sighting_of_ref": "indicator--a20168f4-bb88-419b-912b-d6468fdfce77", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e9a926d-d043-42b5-9c5a-2a9b935efb7d", "sighting_of_ref": "indicator--6767cb93-7406-496b-b14c-8256fb82a2e6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--75b6da84-9145-4832-8034-b58c72d1931e", "sighting_of_ref": "indicator--d8e5c977-1282-4997-a870-08146ca8bb82", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b25330a1-2f65-4621-8a29-930a0c9d11eb", "sighting_of_ref": "indicator--2d2a53f4-3f8d-43bd-8f72-cd7c83bc9a8c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--529834c2-650d-427b-a7ca-00e3c60fd5b4", "sighting_of_ref": "indicator--47fc17a7-64f6-4705-b8c5-b49d05674a20", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40cd9330-5006-4ead-91d1-2e94e99f36ef", "sighting_of_ref": "indicator--57c5197d-a845-45f1-a72f-508eb48c28ec", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--027a8768-c7dc-4a7d-b765-fc9128d2c698", "sighting_of_ref": "indicator--6d2b2fb6-7b05-4c84-bc70-e2ae22be7038", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d6bba4d7-65b7-4348-8f18-7f487faf3ed4", "sighting_of_ref": "indicator--0712cfb8-f531-45cd-abce-3276c0eecab3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25963bd9-697e-4b59-b218-b21d641836cf", "sighting_of_ref": "indicator--959e3cef-5028-4a9e-bf23-35e158791254", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b77746ed-a400-43d0-ae2e-98d5061abb92", "sighting_of_ref": "indicator--53bbec3b-d29a-4935-8f91-c5c3d7c544f3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--47fe3fb2-e0e1-4c79-a556-9099174d9b0b", "sighting_of_ref": "indicator--1bf79228-5ec0-4791-8cad-0d160fc24c81", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--91dd1612-8f96-46b2-aa16-e688907a7462", "sighting_of_ref": "indicator--9b3f7a11-9a43-4456-a751-44410d3f7f59", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dacadf6e-515c-429c-a867-32c5d4942d54", "sighting_of_ref": "indicator--bb299ede-0eae-41b1-b4ec-4f86c410e679", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7a53a5c4-470f-4e25-a37c-e328dca85047", "sighting_of_ref": "indicator--fc94762a-c571-4dbe-804d-97c4568f80a2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--24b8929e-20be-4952-8f08-0e2bdd4fd49d", "sighting_of_ref": "indicator--ced784d9-b365-4d19-889a-568a6a15a805", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17b128aa-1c1e-4f7d-9632-824c0e6c42fd", "sighting_of_ref": "indicator--1094a5f3-4098-4574-8a6e-a74ed25fdb75", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f59fc995-5dfc-442c-a463-e790e2caabbd", "sighting_of_ref": "indicator--2cea6050-5142-46dd-8f46-4336766b84d5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bc08e07-1bb3-4717-9e9b-ab5a9017f67e", "sighting_of_ref": "indicator--a72b462f-8102-4693-ba04-be6a528434fa", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8edbd3df-35d3-4292-bfb8-c91c8d7b8389", "sighting_of_ref": "indicator--43f31c52-fa04-4f5b-b9e8-d4bc639dc9e6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfb02765-f521-4c9d-b3bc-e3f18745093b", "sighting_of_ref": "indicator--c6c5d19a-29b7-4ae2-ad39-96a6af07f4e7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42f1d4bc-c497-4b0a-b509-366e70ab2b8f", "sighting_of_ref": "indicator--4c7efbb0-c1e1-487b-9cf2-439854eec101", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bfa00f9f-d128-476d-869a-d6270b40bc69", "sighting_of_ref": "indicator--6364152d-67ab-4417-91e4-18c6a1d352b2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7789a83-eec4-42ca-88a2-1d4574641b27", "sighting_of_ref": "indicator--e715018b-5b74-4706-9807-57db5cdf8aa8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e48f0ccf-e507-4d54-a2c7-47df380c73a9", "sighting_of_ref": "indicator--c2a47e88-fcf1-489a-9580-f8c176bb7624", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e64ed138-db01-4a34-9e1b-99b5423cea8e", "sighting_of_ref": "indicator--86876d9b-943e-47d4-b44b-964c7397697c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cc31d19-54bf-49f8-88e9-062705f17d99", "sighting_of_ref": "indicator--4557c98f-5ae8-4e9a-88d9-54ba2008871e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--018efceb-4553-40ae-a478-ffc271eed017", "sighting_of_ref": "indicator--2a786202-eaa7-4a89-93a7-f65d3e648f82", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4125fcc2-94f3-44de-a196-243f747b5a75", "sighting_of_ref": "indicator--92533aa0-8583-4eee-8a9d-a1daadbea244", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--834581b8-3bbf-4b03-83c2-5a8a007f9571", "sighting_of_ref": "indicator--12db2075-553e-49b7-9bf9-0ad92fad10b5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55c58259-063d-4bc1-a90f-18af42094290", "sighting_of_ref": "indicator--a71bcc3f-c4db-476d-a8d4-ce1da30432c3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66c510cb-5153-400d-8714-4e49d0fc5c0d", "sighting_of_ref": "indicator--41490e57-8583-42eb-afe8-6f81ca81e58b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cb5301bd-3106-4220-9253-9945c4c70fad", "sighting_of_ref": "indicator--3f9153de-5ac3-4db5-83f8-cbfe441cf9d3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8c9ac8d-4dc6-425d-bfd0-3d55d0701219", "sighting_of_ref": "indicator--272cc8f2-46a4-4869-8e52-4e8b0a89b03f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98f9635b-5fdc-4f04-803f-60beb4954217", "sighting_of_ref": "indicator--598f0b1c-2b98-414b-af30-2a3273b8a6e0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d8d0665-0eff-41a3-b2ca-014f6e599e6b", "sighting_of_ref": "indicator--de28e932-ea85-4400-ac6c-06bfb2eb4b98", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--85b6a153-d93f-4406-8ee7-58d1acbe9b08", "sighting_of_ref": "indicator--03f475e8-7aee-4395-9d5d-f82164377529", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2cb89e6a-8947-455c-9759-4d84f6be17b2", "sighting_of_ref": "indicator--bb84cc76-a099-4c33-aa42-08e53a091b0b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a0bd2c1-609f-4e60-aff1-91549ceace45", "sighting_of_ref": "indicator--6b78b958-130b-444a-ae53-82746b7e96eb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9567402-adf6-4c88-8891-842573146df2", "sighting_of_ref": "indicator--9c77f47e-42b0-45db-8cd0-e220faef59ab", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b94c5444-4866-47db-ad04-ac4e38142ab3", "sighting_of_ref": "indicator--54d9ae90-39d7-45e3-b93f-11ffcd2d04e7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bc637e41-1461-4bd3-97a3-cbb77edbd495", "sighting_of_ref": "indicator--715a8c03-4cf7-4f26-91b5-95e21cd6b353", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8fa67970-51f8-4402-9d6b-fdcb68ac1af4", "sighting_of_ref": "indicator--2c5362e5-0a61-46ab-a211-fd7108c4796b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14ef91d1-c254-4cbc-8d84-d974a0217b0f", "sighting_of_ref": "indicator--9eb9831c-3c90-433b-b62c-baa9c15c7de4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f3b0648a-9ba2-4668-bc79-ed245959d34c", "sighting_of_ref": "indicator--9ca3c064-d230-479d-ba81-d4cfdb0b714e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca588e09-6c6d-461f-857d-31648e0f1335", "sighting_of_ref": "indicator--90e528e8-e45b-4bf4-a788-30b7f7a77ccd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f778628d-b051-4d1e-aa04-e268ce49d946", "sighting_of_ref": "indicator--e9433ac8-0d56-414e-a0c2-317645a81772", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8816fd22-0bd4-468f-b40c-07ff2506c138", "sighting_of_ref": "indicator--f463f251-1b54-4583-9dd8-16dcebc19103", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--458ca600-8da0-4887-924d-96d15f03a6ff", "sighting_of_ref": "indicator--d75d9996-8eab-4cd4-8c54-8ae1490ea74e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5d03e129-ec08-42cb-8ec4-e1aae3cbfea9", "sighting_of_ref": "indicator--e41384f5-0e2a-4361-8d4b-0d3b17e12a38", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--60b4af09-e7ed-4bc0-aed0-123f82c72a5e", "sighting_of_ref": "indicator--4a02489c-a84c-4924-aefb-9d3b4228fc6d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--eef43363-befe-412b-b29a-96d90fcdecc8", "sighting_of_ref": "indicator--9d279c7f-2140-45cd-bda7-3a731d8fae5e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ef23e3ea-4e34-47b4-bf38-1ec9c34f1e8f", "sighting_of_ref": "indicator--35359ade-b4f3-4007-b080-200bd700aa66", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--faf7cd32-f7a6-4899-8f3e-88cae9e60c53", "sighting_of_ref": "indicator--c6d43141-3d96-409d-beae-82caa10e8fc6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69c87b10-bc29-41ec-8782-d0390832ae42", "sighting_of_ref": "indicator--69542644-3b8f-4690-b3a1-09417abcf729", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6a3608f0-d8a6-4974-a398-23cc3b480c26", "sighting_of_ref": "indicator--2d83a0aa-6f35-4383-91a3-0dc97009f194", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--119dbe5b-e351-477a-9425-2d7a83b03b0c", "sighting_of_ref": "indicator--787bd02e-4480-4482-882a-d166bb34249f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd48fe0d-6b1c-4cd9-a20b-d74464e8e3a5", "sighting_of_ref": "indicator--7adf7c11-1bf3-4ba7-891c-4c3b8392cfd3", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2255035a-11d2-4ea9-a539-0cbee0cefd00", "sighting_of_ref": "indicator--d5aa6938-8c38-4cfd-b135-5ffa89134443", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9c6f703-b4de-442a-8b54-8ede982af992", "sighting_of_ref": "indicator--cd1f18b9-af6a-454e-94e6-7e60f6c1d1ea", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6643d6a-cdb2-4f5d-aa48-659899e2384e", "sighting_of_ref": "indicator--16f96bf7-664f-4e01-8998-97ba5906c7a6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1804db94-d040-4408-8967-9e94cf29f468", "sighting_of_ref": "indicator--57e89767-d074-471f-b10c-964117ac402e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60b50de-8533-4840-8bc6-4437f47af392", "sighting_of_ref": "indicator--46150145-090d-40fa-b3fa-f240e0518c89", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d07e04b-4466-430e-8a10-43e8499c6efb", "sighting_of_ref": "indicator--8f0e41f3-8af5-4038-852b-65c39022e1d8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dfd01193-0321-40b4-8920-a83b9bd8f65e", "sighting_of_ref": "indicator--2a0ce547-3636-45d8-99e0-6ea7740ff7ca", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e7ce2df4-8b2f-470a-8c28-be02bddace25", "sighting_of_ref": "indicator--2cbc4686-caef-4594-8513-383c10802681", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d365288-ee18-4b61-9cbf-030d042f5b99", "sighting_of_ref": "indicator--e3b3d062-2def-4cfe-b1ca-bdd202e36bcb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--657fba28-54ab-4b7f-815d-8c14f767cc08", "sighting_of_ref": "indicator--c6c5e6c8-5a30-4024-93a1-41b129672a0e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--03b8c188-4720-4563-8f7f-f48b9be090d5", "sighting_of_ref": "indicator--9650b84e-3743-4b73-99c0-041499840fbb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b388a6c9-cb8d-47fa-948f-1aae63c7414a", "sighting_of_ref": "indicator--6762beab-3541-4a5c-903a-8351e8798146", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa20463e-9adb-4eb8-b977-90d1cd1c4fba", "sighting_of_ref": "indicator--5a81c6f3-d356-4fd1-86c1-c209e90f85ab", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac4723d-2d8a-4510-8ff2-8fc2514793c4", "sighting_of_ref": "indicator--fae0c2c7-4c1c-4674-8d02-672d120439ea", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59f3173d-8ac3-46fb-8466-7ba2fa9af6c1", "sighting_of_ref": "indicator--9964cd9d-bfc4-4dfc-8047-6a996eb7f722", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9288e037-92e3-4656-a404-062d28174229", "sighting_of_ref": "indicator--96c02ba4-42b2-4201-b543-a58a5bcf6c77", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--93c57f5b-4c07-429f-ac3c-db856ec2074f", "sighting_of_ref": "indicator--fa755bdf-af7a-4945-b9b9-4f350533e564", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d9e9b43c-ed55-482e-9f7b-072c53302e6a", "sighting_of_ref": "indicator--1001b5fd-e39d-4280-ae47-36e690072719", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--61453c1a-c7f5-407a-9133-5193fff07857", "sighting_of_ref": "indicator--26c16f04-2732-4072-857b-53afcb95f3db", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cddc1bdc-99b1-4e3d-8444-8b5f322e33e2", "sighting_of_ref": "indicator--15cfbb27-923a-4a84-9139-63841858ef07", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8809fda2-a305-471c-83a4-f998554ae114", "sighting_of_ref": "indicator--2d762301-2534-46f2-952a-babf91349b34", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc20bad4-0e02-4a36-b7bb-a66bc21c2b1b", "sighting_of_ref": "indicator--596dcd09-55cc-476b-a743-16ab4d7c34c0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--700959d8-2d54-473f-946e-b1d3d8432917", "sighting_of_ref": "indicator--96773662-3a3f-47b5-a0b3-a07e25c6e290", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--719cedf9-52b3-4df2-bf19-1beae8830d29", "sighting_of_ref": "indicator--4352527a-4868-41fb-b315-08aab1b4eba1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3772db8e-85d3-426b-ac10-a0253be3837c", "sighting_of_ref": "indicator--73a068c0-7d91-4117-bf9f-e9df9ad81da4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--41dec130-6d6e-4c00-84d8-6aa62b254bf6", "sighting_of_ref": "indicator--97d0224e-0901-4fa0-bd11-09cd032fd510", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9c52cb9-2616-4668-9931-dce73ec660b6", "sighting_of_ref": "indicator--bd3ca081-87e2-41b4-b6b2-c8aec93ba5f9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fba7426d-d0ec-493c-8894-ec1dc7bb056c", "sighting_of_ref": "indicator--fa8b2d5f-9088-4a5b-b34c-d0ad51ce2d6b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9d493925-9be0-4a33-8a05-dca2f4ee9c7f", "sighting_of_ref": "indicator--afc533d0-693b-4200-bc5a-cf4dae3fc124", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e78d93d4-4ef4-44d6-9ee9-da7afd52641e", "sighting_of_ref": "indicator--d40c60ae-821c-45e0-a96a-c63ec654268b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a641b5ee-a63c-411a-ba2d-310d46904cf5", "sighting_of_ref": "indicator--63f874d4-cdbb-4cbb-a2fa-b132b10c8776", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59fad8fd-b352-401f-bc18-427b98333c70", "sighting_of_ref": "indicator--f8aae3e0-663a-4820-b458-7b03dc1fef41", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1dfe694f-4f9c-449e-b91a-1a6d9c243a81", "sighting_of_ref": "indicator--d94b997e-989a-4c36-8cda-8d8451df7873", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--43d693da-9859-443a-ad89-8ff23950cbbf", "sighting_of_ref": "indicator--afefc47f-32f7-4607-aaa4-f6b3d368893e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--81871a69-84b5-4537-ad71-aacbcd39d79e", "sighting_of_ref": "indicator--8f215dc2-934d-4f2a-84f4-4b691a52e92f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c2b9786-9b23-495b-a4cf-65c1b6a409ab", "sighting_of_ref": "indicator--f396240c-aced-4f71-9e45-087c2bd7b6d6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--618fe71c-6f0a-4f50-a883-fcdea3d977ea", "sighting_of_ref": "indicator--0c53fb79-60a8-475f-972f-07b665e3ca07", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ff06fd02-4411-4fcc-8508-1af6b9afe2af", "sighting_of_ref": "indicator--daf8e753-605c-427b-9972-1512dd47d3c9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--624064e6-d562-453f-8075-acb5c44376c5", "sighting_of_ref": "indicator--841be80f-9ab1-4d64-ab95-83cbe3620bea", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e918f27e-2d6a-4b7d-874f-3b8a4636a3db", "sighting_of_ref": "indicator--0bf032ce-c336-4540-81c7-e9492bdf1649", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a35b67d4-043f-44f3-83ec-7b9e2d29e1f8", "sighting_of_ref": "indicator--45ae2426-2b2e-4cb8-94dc-6e1495de3898", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dbf08d7b-1c41-499f-9e26-7f91d4c1162b", "sighting_of_ref": "indicator--943af044-1bf4-4d95-bda8-7cb8dfc7948e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5e30ac09-f3cc-42c0-9b53-7d2f55fc0e45", "sighting_of_ref": "indicator--40dfb008-c531-4ca5-bb0b-8e10be5f1f61", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de5f9e8b-998d-4a3f-8f58-898ca94c6d3e", "sighting_of_ref": "indicator--f2b28349-29c1-43a7-8804-3d13e8412776", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--800738dc-4de9-4e51-bf54-22401282fde6", "sighting_of_ref": "indicator--e845621c-e5c3-4e33-a53f-bafaff488717", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d11b3727-12bb-46cd-ad90-a36eac05ecd6", "sighting_of_ref": "indicator--72e00293-e7c6-47e5-8485-f70659e27e4f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3df5d2c6-d242-4d76-939f-ecb1ce9cde10", "sighting_of_ref": "indicator--7eddc338-0a08-4880-8e05-d0ad95b458d9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--84c231f7-3ed5-4602-95a1-b7516182ab2b", "sighting_of_ref": "indicator--f2636d16-c0b6-4c77-a226-cc35a5846a3e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--17c559d3-daff-45bf-adce-69d238ea0e6b", "sighting_of_ref": "indicator--92003f45-42dc-4e13-9b7a-eee641e4d1e0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1778db1a-b85f-42aa-bd2e-85a02d53c792", "sighting_of_ref": "indicator--908df4f1-e5d9-4a18-b2c2-45a77b2711ff", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--19d74da1-c40c-4790-87d6-b16a4e6df78c", "sighting_of_ref": "indicator--861168dd-2638-42bf-8a27-da2e745ffcfb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--94807b82-019b-4b0a-82bb-3080df2dcfb2", "sighting_of_ref": "indicator--e875422f-5ff7-47ce-a4fd-1d7cf5a18567", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f0c67ad-aceb-4b1b-9062-f7ea07e3bc5e", "sighting_of_ref": "indicator--415f4d8e-5320-40e6-a8db-022755d6a9bf", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9a0e0d6f-189d-47ee-852c-6434145a8f17", "sighting_of_ref": "indicator--68fa6eaf-9fa0-4b59-a145-5efcea1b1a6f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db79092d-961a-4458-b3f9-bc93816312ec", "sighting_of_ref": "indicator--e34cb19a-d54b-49d7-ba02-8d6a751e9b87", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6749a247-c0e0-41a2-9996-c9244482f42e", "sighting_of_ref": "indicator--8a13d9ed-c439-4f85-bf8f-70b119288ac7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f6290ced-924f-4524-b126-6ded409acc59", "sighting_of_ref": "indicator--44879a2f-1c65-4fc7-9095-364021f16fa9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d90fd29-afaa-4b71-9c8f-18c666fb7377", "sighting_of_ref": "indicator--9fcb48ad-366d-40cf-9b06-1859c819bd7c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b355d91-d486-46bd-bdd0-e6b3221997ec", "sighting_of_ref": "indicator--8ed64fdf-e1f6-4138-8941-f8bd4b9c7502", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d770b99-5adf-4d8c-b85a-03df52e90fe8", "sighting_of_ref": "indicator--45eeda4f-fe28-4894-b475-67c04316615f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06162a45-e6e8-435f-ab5f-0ef0e400ae50", "sighting_of_ref": "indicator--f9b58a75-84b9-4524-8df5-64e56471d448", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--867afee0-c03c-4412-ab53-785126965aa7", "sighting_of_ref": "indicator--4a1f22fc-9c0d-4461-8c8d-48923f72bb86", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2faa6d45-3910-47a0-a7b5-1cd7146cb17c", "sighting_of_ref": "indicator--827201e6-0462-40a0-9115-ffcd3a38a7d5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--952e76d4-ab09-4f2f-a322-334da510c8a7", "sighting_of_ref": "indicator--0b12bf0a-263f-4f87-8d06-05a51faacd1d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b6744bf0-5595-4e6a-a757-d1607d570e86", "sighting_of_ref": "indicator--eca142ea-d528-426c-b812-ac267826be37", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c7d4076-ecfd-457b-a13c-7d8e6ab693bf", "sighting_of_ref": "indicator--892912a8-a27e-437f-8fc1-961eb824fc7d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a205111d-fd1d-4803-aaa7-e5019edc3468", "sighting_of_ref": "indicator--acac1119-87c0-404a-81a8-441ba6088d7e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a95de01d-a6e0-4026-9094-de9160b9ecaf", "sighting_of_ref": "indicator--53c3e7ee-d944-4fc3-bae8-f14eecd27b06", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8b78876-4049-404c-b0e6-083926c2e720", "sighting_of_ref": "indicator--2bbad52f-845f-435b-af3f-ec2bd4bf2ba7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--66afe80a-4d28-4a2c-ab81-cc9c001e54e6", "sighting_of_ref": "indicator--1e396a63-4127-4f4e-9f86-3b9d499d51c4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7431d013-4f6b-4496-9a3a-8c862baf2098", "sighting_of_ref": "indicator--0679c46a-7f18-460d-961b-b7126ac3038f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b24045dc-c988-4efc-977e-f8ea87c3b68d", "sighting_of_ref": "indicator--ba1e5d43-4a43-449e-a1b5-6d2b20f1c17e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bcb1dbeb-44ec-4f19-a3b8-ef5c1da7b2e3", "sighting_of_ref": "indicator--9cedd06a-f867-4b31-92cc-045396e59554", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ecd6332-91f5-4767-bf8f-b1f200f3884a", "sighting_of_ref": "indicator--d4f003e9-cc15-4509-a38f-90dee9440454", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e96cedbd-4119-478e-acc9-72e8371cb916", "sighting_of_ref": "indicator--9094978e-cd68-4e08-8cee-76951e98bc22", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e9bc2f6-7f30-4ffe-851b-9103a0e23750", "sighting_of_ref": "indicator--ed4a1c0b-3874-420a-9e2e-4c90d2dd9c41", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--33b02d13-2b1c-464c-a3aa-f5e1bc6f3a19", "sighting_of_ref": "indicator--74cde68b-c9e0-413d-985b-76feb4a127c5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a12098ac-1988-43e8-a13f-e4327f7e8478", "sighting_of_ref": "indicator--2b5fccc4-0d79-4ba9-80e6-923de27eb01d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1614963-a0f5-4b30-985d-412798c01ec5", "sighting_of_ref": "indicator--f935ed6e-622b-4274-9d5d-5a69bb498107", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--35cb8df1-c8bd-4914-b20a-61c5b5148ad6", "sighting_of_ref": "indicator--cc958b15-b12a-4e9c-9c54-f6e5293a920b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--bd711c3a-1cca-4de6-bd7d-31207a10e410", "sighting_of_ref": "indicator--2e2d063a-9c9b-481b-8139-67e45524fe35", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b3ced5a8-ce14-4794-9393-499acfcf5b76", "sighting_of_ref": "indicator--378cf488-555f-49af-b6f4-b5823237990b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7f2ac8b3-6609-43a4-9668-69ff93f75fee", "sighting_of_ref": "indicator--86263375-e5fa-4701-9374-5047c8c41dfc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--31cfa62e-d780-4228-bb83-1617b37714fe", "sighting_of_ref": "indicator--cf371fb9-8e82-4b93-b560-e74f9ef25ae6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--271b7f38-6369-419a-81b2-37ea164bb319", "sighting_of_ref": "indicator--49399c22-ce12-4e33-af05-0804be45b4ae", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1072ed77-f1aa-4920-b793-2ab2bc5ebd2b", "sighting_of_ref": "indicator--b18af023-b8bc-4c1e-ae35-702017723471", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4d51c9c6-e10c-483e-a6f8-0c49a6c6ebfe", "sighting_of_ref": "indicator--7830df2a-654f-4131-85cb-e43070bec37a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f4b44b25-7544-4575-8570-5349a4e68d91", "sighting_of_ref": "indicator--5ec16020-df4c-4128-a6b8-6fd6bfd781a2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b7654818-0428-432d-aed8-7b14f9a3c7e2", "sighting_of_ref": "indicator--67ef490c-9fb3-4b37-9184-a31d774a3ea1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--feca446e-57f9-45dc-91b5-bae36a2bb4fe", "sighting_of_ref": "indicator--246ba778-edde-4245-91d0-83f4bdbebe28", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01672eeb-7dbc-48c3-92d2-52708c9d923b", "sighting_of_ref": "indicator--18d6d57f-4ff9-4732-a4ba-10a8fedee453", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8ee4a2-b8a4-46ee-9528-ea3ad2d58b4a", "sighting_of_ref": "indicator--e32995d7-3265-42f7-b0f8-225876868377", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a83a0529-10ea-4353-a303-e9640e338738", "sighting_of_ref": "indicator--a9c203b4-070a-4ffd-bcef-880d3ecc1af6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--40093765-7b1d-4cde-8f27-d066b7306a54", "sighting_of_ref": "indicator--60715f12-00db-44b8-8b82-c78248397a23", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa265a80-ed11-4679-b3ef-430e4dde208b", "sighting_of_ref": "indicator--baf49183-315a-433f-9680-84247a4f9ebe", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--42e61666-e4aa-4c3f-af06-ce3c36827bc7", "sighting_of_ref": "indicator--46990ff8-d9aa-46ce-becf-6355f0353a1e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8d39a53b-3f90-479a-b818-0178579cfa2d", "sighting_of_ref": "indicator--d2133bb3-ef02-499b-98b4-05d5f38d57e9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b60e1ff4-3e1f-4784-b1aa-5c809f26394e", "sighting_of_ref": "indicator--d218d0df-1dfe-406c-8d28-fc5bad7a4d2d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2368ef1-47eb-4ee4-ab7a-ac8c709e899d", "sighting_of_ref": "indicator--7a37b5ac-4116-4b1c-9454-6676b478e98e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--26760340-3bd5-4f7f-a963-520ab773c08c", "sighting_of_ref": "indicator--62b60522-8d19-4643-8b10-2ebf05408d70", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6cd56a5e-95b0-4f62-b0f6-4b0cfb35123d", "sighting_of_ref": "indicator--17001d36-3340-41ec-b79b-06cb66d57b44", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0b89baa6-54ac-4b73-be08-6b243ed10caa", "sighting_of_ref": "indicator--9d1aeea6-e045-4440-84e8-9037ace4c75d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc1b636a-28d8-4ce7-8582-a9dddb8ae26d", "sighting_of_ref": "indicator--47ce58c5-04f3-4c82-bac4-efe9b825fda2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--98b60427-c6ab-48e3-85e2-039e83ace1d1", "sighting_of_ref": "indicator--422c935f-d326-42cb-b318-8838d7ad5d72", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--14bb4041-42ab-4f53-840b-6854ca33104a", "sighting_of_ref": "indicator--6c5e9057-3839-405a-b932-d9e69f6ae89f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e6987fe7-5fe0-45ae-b70f-65e4763edb60", "sighting_of_ref": "indicator--74cdfc81-5fc0-4607-ab37-d605c8bc2cbb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a63dc445-b84c-47fd-8cdf-9e806a020dc4", "sighting_of_ref": "indicator--9150d2c0-a179-4fa8-8095-a00158dc8e11", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2f8f79a-e3f8-43ea-8d9c-72fac3c8d0db", "sighting_of_ref": "indicator--bce88072-0210-4553-a772-f6e6bd3f1800", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e1cb0a6d-f39e-43cc-86c2-48cfb750e262", "sighting_of_ref": "indicator--5eee6e51-cae4-48ab-abe1-bf0a9db355b8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dd384668-ac82-4024-8121-9eb49deb6a8c", "sighting_of_ref": "indicator--032804aa-7546-488c-8018-9d01c977b002", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f263afca-d29c-46b8-8fda-92cc4c050c12", "sighting_of_ref": "indicator--2c5178cc-d0d1-40d5-9b78-d469e1f5bf70", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d7c24325-6831-4c58-b941-edd804c9f4a3", "sighting_of_ref": "indicator--bc6f3764-47ab-4e2a-bb21-49d2bc5815e1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--918b923f-794e-4983-bf29-1bed8f29da04", "sighting_of_ref": "indicator--eb1ad34e-6b16-4f9a-a7f8-e115d18f7a42", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1db509b0-940d-4f10-82f5-6c34a9c80f2d", "sighting_of_ref": "indicator--ab9ea132-3577-4085-9047-3cce0b782ead", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cf830150-5b4d-4b40-b54f-495fa32b2176", "sighting_of_ref": "indicator--b429589e-9aa7-42d5-805d-409d9a8036e7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b373f5ca-8ae7-4895-9d3c-e9d442b28041", "sighting_of_ref": "indicator--6dd84eaf-3d92-4f5d-90d2-ceb3f9beff04", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ca2fad91-0491-41b6-9fba-69b31d552eae", "sighting_of_ref": "indicator--b0ce686b-9aba-4860-82e4-c3a5d620eede", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--59c7eb98-2437-4851-8998-62f775bf0c32", "sighting_of_ref": "indicator--2da7d94f-01bb-4dd0-8d39-70a82bdc6e88", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--de2acaf9-25a4-4a34-80bf-013d1bd8ce07", "sighting_of_ref": "indicator--c6128af3-0c92-4fb8-9415-5999821854e8", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fc88c874-e7b7-4469-96e2-9f5bd92aee0f", "sighting_of_ref": "indicator--dab1672e-a8f8-4f57-a1a5-8f011b1c8e22", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2ad0db52-c019-45a8-968b-06b01cb3b956", "sighting_of_ref": "indicator--6a000233-1b7b-4c5b-a80a-c1e09ca7f4e9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e208d4a4-8525-47bb-8035-e6f12995a29d", "sighting_of_ref": "indicator--317d656f-e428-46d0-8ca4-dfc2d345989b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f2aee2d-ae37-4054-aa7f-c15d4805554d", "sighting_of_ref": "indicator--81f0d181-356f-4a66-a833-32c6868f9e3f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--71501c9c-f85f-4986-892b-b15072b04fc6", "sighting_of_ref": "indicator--02bb0d42-6008-4cb5-adcf-f8f58414efb1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3757f159-a844-4482-9e16-c3b2371842a5", "sighting_of_ref": "indicator--0330eaf0-4a8f-4a84-93eb-3936ab7a130a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e835cac-89ea-4e74-b69f-69e3d98b04f0", "sighting_of_ref": "indicator--1a46fe13-d32d-41f6-88c7-784ca0778f03", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f15c227-452c-4e08-9ac7-592899d73e9b", "sighting_of_ref": "indicator--f3e4d1fc-da0d-418c-b6ab-2d3243493695", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4454a412-1200-4712-8513-5fcd15cbe2fc", "sighting_of_ref": "indicator--85850378-99bd-46d0-a5f0-de24586981e6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d0b0844a-d556-4d4b-ae0e-aff418822aa6", "sighting_of_ref": "indicator--d378cfb4-9a4f-4fe5-a102-d3407a77b7ac", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6d701794-742e-43c8-ab96-7d157d988aa7", "sighting_of_ref": "indicator--de391b73-5a08-4e3d-95ad-4a4a0c9b5f40", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--db6c228f-935c-400d-94df-8951b8eaa970", "sighting_of_ref": "indicator--73486344-304f-4b2f-b9a5-f632658669eb", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5386f0bd-14f2-4958-bfc6-47a7c564172a", "sighting_of_ref": "indicator--a3444681-8f3f-4377-bca6-829d04faa0f9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--298ecbba-b9b0-42c0-b8ab-a43a29592398", "sighting_of_ref": "indicator--762d34cb-db7f-49a9-be7b-1e999c8a5100", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d191885c-d967-4c6d-9b9d-a2663e434fb5", "sighting_of_ref": "indicator--f2766f83-ede4-4cb1-8b20-0d09acedf752", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2620de22-d8ef-4b92-90ca-d5cc455cddbd", "sighting_of_ref": "indicator--19a1614a-b425-4523-8277-eb184c39ade5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f52c9fe0-14ec-4835-b449-e01a2db2ecf3", "sighting_of_ref": "indicator--4d8c10c4-7f25-408a-8851-438b76df703d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2943156f-09e7-4312-a4de-1be2104d1610", "sighting_of_ref": "indicator--130ee2ba-dd04-4072-b5b9-aef61ad8b4ab", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aaed64f2-fa37-4acd-b333-86ee4b57cde9", "sighting_of_ref": "indicator--c214e169-d34a-489c-bdd1-e134233e99a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8f6f013-ca69-476a-92c3-e24d1e389b50", "sighting_of_ref": "indicator--42f1d1cc-8172-4b99-8563-bb12aa782f70", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--88aebf41-a680-4c8d-b645-9c9ddc6d9ce8", "sighting_of_ref": "indicator--c74714e1-9ed6-40d5-87f4-a2ef81a237b9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c43d8ec0-9a28-4c60-8be1-bff71430c8c4", "sighting_of_ref": "indicator--9eb00e87-050a-4bc8-8fb1-456ff778bcce", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b35457d6-96b8-4c6b-8e22-36dda76281bf", "sighting_of_ref": "indicator--a63bad11-2b21-4478-a6fc-09b56417a263", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7710fb9e-f5c2-4a1b-adad-cc271fce6397", "sighting_of_ref": "indicator--cc06dfe5-baf4-414a-9bcf-702e1475916e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--53688390-ce65-4cbc-b91f-54f04b95c69f", "sighting_of_ref": "indicator--9af34cfb-5219-4f5c-81b3-8ceb3e324d69", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50736f28-30f6-4109-bae2-ba2317e80132", "sighting_of_ref": "indicator--199dbcf3-abeb-43d5-8371-edf4ac46aeef", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6e623f8a-73f5-4741-a6a3-bd0cb6cfdca8", "sighting_of_ref": "indicator--660f2c58-a024-4540-8808-1a35e8638186", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f7b63e0-fff9-4168-9820-1deda136d748", "sighting_of_ref": "indicator--8d0672d6-6b02-4224-99ba-6355af0786f7", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--dc942cbf-a9cb-4a7e-9ae6-4b4fc6e713a8", "sighting_of_ref": "indicator--060b7aa9-4916-4624-9b2b-16557af2e15c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d420c3c3-778f-41b8-9f6d-46310096602e", "sighting_of_ref": "indicator--656e54c4-d5e2-4647-b827-1949e6a2e9dc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--25bd3e1b-c0fd-41b7-b327-436da714d2ad", "sighting_of_ref": "indicator--eed4187e-c914-4c66-9180-139b6260c95b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--226cb686-b49c-428e-952e-9f812d933b8e", "sighting_of_ref": "indicator--26e604b3-a212-4b09-9978-14e9106ce5d2", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d84c8cf4-6bf5-4db8-97ee-ca5bad031ecf", "sighting_of_ref": "indicator--cd65b0c9-3ffa-46a0-8b4b-773ca62c1b41", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8ce848ac-ca69-4aac-90ec-6e0b81a8cef9", "sighting_of_ref": "indicator--5cf5c0ed-7ffe-4d46-8308-0e8dd3a74286", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--504e8fab-cf36-4d72-839a-49b8cf543d5e", "sighting_of_ref": "indicator--35d5d414-34e6-4770-a852-7ed93ee085df", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--cc063065-f565-4136-8e92-4cbf39db0a7a", "sighting_of_ref": "indicator--cf722387-a6d1-4b7b-bf96-79a6eab7393e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2006afa6-b41a-4460-99d8-d73fd8992b4c", "sighting_of_ref": "indicator--48602fc0-f865-4449-ba63-8193352714c4", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d2d7a267-fb81-4411-8df7-f0bd67c473d1", "sighting_of_ref": "indicator--c2f9aabf-92fd-4467-96d8-99af88b16d80", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--69224cc1-16d5-4c05-8e7b-730b097f3bde", "sighting_of_ref": "indicator--bdc82a00-8118-41fb-beb2-dafa99e5fe24", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--28a9752a-b260-47bf-8f67-5e89b0493886", "sighting_of_ref": "indicator--42f5eb2a-96a5-49d4-a7ca-4e8a6f5c37a0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9295e80f-0809-4bac-902b-080b9148adf4", "sighting_of_ref": "indicator--19fa3f03-4936-425a-860a-88d8d3792b95", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--595134b1-5503-4586-b402-50ff3ffc29a7", "sighting_of_ref": "indicator--9e16596a-bfc7-4187-ad33-c51a6529fb01", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1d97c7ae-3846-4250-9e90-2fb406fb8cc4", "sighting_of_ref": "indicator--d2662767-816a-4219-87d8-0d2e80e8bf61", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--06eba541-285a-45c1-9a52-317cab1811ff", "sighting_of_ref": "indicator--2137f7f8-5f58-495e-b5dc-543702f26e9b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1f6b07c0-5fbd-4c7c-8418-0ba182dbdc31", "sighting_of_ref": "indicator--4fb2e944-168f-4838-9d50-286c326c948e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--003a0d05-85da-4f06-bd1b-9aa69d0b6bab", "sighting_of_ref": "indicator--11e33d1d-e903-4c76-a95e-3dabe31179a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--01bee517-8c67-47be-b28e-bb50153c3910", "sighting_of_ref": "indicator--bcd87c2d-7995-46ca-8190-072576165418", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--900ff701-3899-4914-9393-e1ecd235b7b5", "sighting_of_ref": "indicator--28d186d0-72b8-47e4-8409-f263f5705f15", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b5fee7b8-e26f-4bc0-8fcf-8ea9d1a11cdb", "sighting_of_ref": "indicator--be07d3c3-681e-4d56-ae70-6f50b05f3e75", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--146b43fd-9ee1-4883-b40a-01ea7fa30db9", "sighting_of_ref": "indicator--58107399-8b2b-4fbc-bf03-e03093b077d9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--57ec1ef4-a2c9-4162-be70-da051be70e45", "sighting_of_ref": "indicator--bad7f93d-16cc-42cb-b303-fea265fb367f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a7bb6ffe-1bb9-4ada-a25a-a1c8cb90c72f", "sighting_of_ref": "indicator--70124300-1957-4693-95b3-645a9fb23708", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--45f64ca2-5168-4a00-b0c7-69434e377910", "sighting_of_ref": "indicator--b3add3dd-d3ac-44ae-aa7f-c6b90410f46e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3f17b6b5-54be-48c8-8389-1e30c6f5aa9d", "sighting_of_ref": "indicator--e4ca77be-d263-46cd-b7d4-a9f69624e1a1", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--583da71a-06ba-45db-9c2a-3bd014f42182", "sighting_of_ref": "indicator--077396e1-3801-4b6f-ad3d-fed257876d4a", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aac5b785-c481-4acd-bb9e-232765cde35d", "sighting_of_ref": "indicator--f7d20051-ff28-4e1d-81e2-e5983b6be158", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d8236d1a-699e-4777-9663-53e251ae9f26", "sighting_of_ref": "indicator--ff2514f3-1f2e-45b5-8276-e047a1bd584d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e92eaf49-3815-4cad-a433-a3b1911afecd", "sighting_of_ref": "indicator--0567da39-f7c7-4971-8bdf-d870f07f6bcc", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8f743cca-094e-4d87-a7d4-4aac1948bf1a", "sighting_of_ref": "indicator--1e94fd9b-944d-4be0-9a6b-1b2cac5ac29b", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c8f9d14-1578-4772-96f5-30b04948d132", "sighting_of_ref": "indicator--7f9ff354-2adf-4b54-a5e0-2c4433f49210", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e4872643-3e6e-4a02-bc03-4e8e50922023", "sighting_of_ref": "indicator--685d62c4-26f5-4d93-94ea-63c1cc1afee0", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3da40b17-4a24-40fe-8380-d8312e0b47be", "sighting_of_ref": "indicator--c6b43ab2-d290-4804-8e0e-e4f9cced5145", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a48f955c-8453-4e0d-8667-a422ada6da77", "sighting_of_ref": "indicator--fa284c84-02b6-42bd-b7c2-a42ad30fe05e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--92cdc19a-d2f2-4080-b5ee-a757827019c2", "sighting_of_ref": "indicator--3cc4d65a-baff-4614-bd2a-aafa9f7775bd", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--adbdcfdc-2f16-409e-928e-a7de75aac2c3", "sighting_of_ref": "indicator--6a7482c6-2ea2-4afb-ab53-4d0624dd730e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--536ee486-68c5-4cdd-aceb-19b4ddff5347", "sighting_of_ref": "indicator--1f39e8ec-c322-4a3c-96cc-48629049285f", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e9c1a87-4295-4344-adf1-8732e57dad32", "sighting_of_ref": "indicator--c4d53075-adde-4964-b3cb-fa30e7bf6ee9", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c5c2f108-be1b-4d2b-8b1c-013cf54e2f93", "sighting_of_ref": "indicator--9a7408fa-baf5-48cc-9744-29184d6bf468", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b57d11e1-d0e1-4c96-ad21-32221e653578", "sighting_of_ref": "indicator--5623eae0-b33f-42b7-a7be-d8627409ab4c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9e6b84e-6053-4f2a-a9f5-df7247b8e3cf", "sighting_of_ref": "indicator--82f51d2f-67d2-4168-847d-3364887f9b10", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e19b7894-3d43-4770-8bff-23fa376fc1bd", "sighting_of_ref": "indicator--d28eb363-1f56-42c9-9745-2f2ae6ab849d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e73d74f3-bdb4-4a2d-afc6-95e2c384c2cf", "sighting_of_ref": "indicator--6a48840b-cfed-499b-b9d1-7c5d31bb3f72", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b0a0f69d-f250-421c-bc98-ee2f60468d4f", "sighting_of_ref": "indicator--37954cfa-8795-49b0-89bb-d56042263315", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a226db12-8119-4600-85a4-a64969b8b010", "sighting_of_ref": "indicator--86b6e557-891a-4366-978a-38bd8900d00d", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--76c3d4ac-6de7-44f6-8552-cd1ad3e89ab7", "sighting_of_ref": "indicator--c7e803d4-7d6e-456c-bf48-1b407ffa26c9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--63758b9f-9bf8-4258-8ae3-91473ce88726", "sighting_of_ref": "indicator--2db807ee-a5d4-420e-955e-07ce857a2ba5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2074cb9e-5609-45e5-a6de-2a02bc55751f", "sighting_of_ref": "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8b4b154a-8cbf-44c0-b40d-9b653545e49e", "sighting_of_ref": "indicator--a9542e6e-6804-487e-a0b7-5c3090c8bb1c", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0ce9708f-7220-47ab-9c7a-17f6b42cc2b8", "sighting_of_ref": "indicator--f8e116fc-8be6-47bb-a2e4-12c3aabe3255", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fa78e62c-4166-4253-b0b0-521d297eeac9", "sighting_of_ref": "indicator--1561d3ca-34f8-4c4f-abb0-e2966e9002ed", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--50c62541-4d95-4d5f-98dc-1d906edd3cc9", "sighting_of_ref": "indicator--78f61c41-94f8-4ac6-903d-316ad8c434fe", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3e7ff2bc-d8a0-4818-a59b-9b0aab56becd", "sighting_of_ref": "indicator--8ea9919e-a7e7-41ec-ae7b-394fd41b8d80", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6ce3e7f-7736-4105-8d76-b58ce78ee576", "sighting_of_ref": "indicator--78f739f1-f60f-41e0-bbed-3b685988101b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2458d671-e4c1-42dc-b418-3c326e9bfec1", "sighting_of_ref": "indicator--092acce7-5b92-4a38-9f26-5a1d11b5525a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7c7c7a1a-c3ee-437d-ad7c-bfb736293d29", "sighting_of_ref": "indicator--51817b48-78dd-45b4-a190-aca4de1d0f40", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--90ec8005-7c10-4e1f-8eed-a87e93fc65b3", "sighting_of_ref": "indicator--217c17c9-eff3-4ab1-aa57-6f1bd11fbba9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c2d0ec8e-971e-4d65-a939-b3013c321725", "sighting_of_ref": "indicator--11b34389-c67c-484a-9d4e-67c003c826fd", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae79497a-87aa-4607-9b9c-c79f4221f99c", "sighting_of_ref": "indicator--a3de055e-3679-476e-b598-bc1aab948115", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b8f684b7-3746-448c-9ca2-231344dc23ea", "sighting_of_ref": "indicator--f4cb7a55-f60f-401f-801a-630a204b6163", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8c1f089b-b223-4184-8d94-b68ac6a8e1c6", "sighting_of_ref": "indicator--1b191f29-195e-42fa-985f-3966a19dbc89", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c40a867d-d13f-47fc-8141-1c7f3a307a6a", "sighting_of_ref": "indicator--c29b9ce9-890e-4b80-95bd-f6191c3d744c", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--95bcff3c-21ac-4968-9cc9-b12b81cd97d0", "sighting_of_ref": "indicator--56b8bd63-cba0-49c3-8389-fdd6dd383903", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7814af45-c5fd-498b-b070-b6d9557d600d", "sighting_of_ref": "indicator--3116acc8-d001-4a85-b87c-ea091205cf7b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aea7505e-6019-4651-a375-22df4ce2d114", "sighting_of_ref": "indicator--04d17887-d118-4ef0-804f-868ce610a311", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c8524351-c739-44f8-bc77-075c9ffb2884", "sighting_of_ref": "indicator--f21ea352-7471-4204-964f-3174735d7723", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7cbdd004-f211-4ff9-b373-cd7260f09a02", "sighting_of_ref": "indicator--61897aa8-31ae-4b92-bb62-98a31febd162", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4c593fe6-087c-4579-9d2f-314d4c489e8c", "sighting_of_ref": "indicator--f43ac588-c8c5-4468-b6f6-5a5d3802f68f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--02de401c-4bc8-4079-b418-a77f3c93fde9", "sighting_of_ref": "indicator--7c9d7ea0-dfab-47b5-8f4c-06b86f4184f6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1e8f7c93-75b5-493b-9042-278e7d5626e9", "sighting_of_ref": "indicator--e308792c-d8f4-4f6d-86aa-230e216411b9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--6956af90-d2e6-42d0-a65c-89863c442d04", "sighting_of_ref": "indicator--c035d8ad-071b-4670-a029-ee6ce1fd59b7", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--954913aa-29c9-4e94-8ff6-12a9944f348c", "sighting_of_ref": "indicator--18e0f940-af21-4e40-8356-1c3089104482", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--55ba47c0-1d51-454f-8cea-b70f969bc86c", "sighting_of_ref": "indicator--9f58eb68-e139-435d-b72a-5fbc70a10d73", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0bb455e4-fb77-44b5-b467-9a521f72a067", "sighting_of_ref": "indicator--82954662-31ba-485b-b282-1cca5ba69d64", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--0401d4b9-0ee8-4bab-8a51-95425a366d4c", "sighting_of_ref": "indicator--e1ab0f09-4695-4619-83ad-aff6054f9847", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83f2211e-ef3d-4ca9-a0c6-8d0c5d6e4508", "sighting_of_ref": "indicator--5b0833d1-4298-4e18-aa4b-27744aa331e6", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3bd5852a-4379-4902-8758-e2649818126b", "sighting_of_ref": "indicator--da7bc62d-8332-4437-830b-c39b93ad214e", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--aa20ba60-d6ce-403b-b10d-b95cec8ad19c", "sighting_of_ref": "indicator--286312be-4fa4-43cb-85c7-c5c114b91673", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1a2b1cf7-3c2e-47c8-812e-7e57f7602d04", "sighting_of_ref": "indicator--eace909b-732f-464b-afc7-403e189cf77c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4aa0bc20-9c0d-4a4c-a893-9392d8796cfa", "sighting_of_ref": "indicator--9af22944-3f3a-4073-9352-51eeedfa80e4", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--2eed76d9-5495-4eeb-8565-7ec21d15ffaa", "sighting_of_ref": "indicator--e3b09310-3b4f-4fba-a3bc-65740cbf468a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fb3a9a5b-e07d-4ae2-832f-d68c749af8dd", "sighting_of_ref": "indicator--551f7973-46d5-4c2a-99dd-6e37dd812629", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--649360a2-d86f-41a6-9115-1c6346c1e833", "sighting_of_ref": "indicator--ea23d6af-50ae-46dc-9c26-9031e8d89775", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--23815342-5ee7-45c2-8e16-b2ba87dd1e97", "sighting_of_ref": "indicator--ced548bc-288e-4dc6-b1bb-cc0ff4572259", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e9397567-40a7-4bc5-9550-e00418521067", "sighting_of_ref": "indicator--43657b0e-810f-4ea3-8ef0-24073e11b432", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4f46a84e-39a0-44d2-9911-7fad851c5350", "sighting_of_ref": "indicator--94bf9cd0-33b1-4478-87be-dd74cbfb2cea", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--172bdbd3-8010-44be-9494-0683a9753997", "sighting_of_ref": "indicator--eb77dce8-9bf3-4df1-9d9b-0b4f15bb5830", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--7e29f0bf-46e2-48d1-84e1-1dee580116ea", "sighting_of_ref": "indicator--e7bf32e2-abfd-4ccb-8e61-7cd0dd4fdd4e", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ea42bc16-cfaf-4640-af3c-b0cbe2265b54", "sighting_of_ref": "indicator--214dfaf2-3dc8-4000-8773-d6c26f526f9d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--83876713-3ccf-43bb-9fa7-654c21b582ce", "sighting_of_ref": "indicator--395790ef-ece6-43e3-9298-0a7db9040485", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6836ae7-0ab0-4401-afe8-95729ea60894", "sighting_of_ref": "indicator--16971f00-eab2-4a5c-b3d9-600552287a74", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1fc5f60f-5a10-4755-b14a-666f097c7c51", "sighting_of_ref": "indicator--ba060711-92a4-4d9f-95ac-22b17c565fb9", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c6f3ce88-c52c-4b23-bf51-0e4cb0edae82", "sighting_of_ref": "indicator--d30d793d-6ac0-4b48-9875-7c32f7e69b99", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--29be6e11-1caa-4805-8867-3e3b9ac9fd73", "sighting_of_ref": "indicator--4d3a3e83-384c-44e1-8eff-23fb65c8567d", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8df4ee31-67a3-479e-9cbd-f8e3ead88978", "sighting_of_ref": "indicator--eb2f0dac-d1d3-418f-b354-7de65c36921a", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--8321b70d-b63b-4aef-9fca-059332c8cc2c", "sighting_of_ref": "indicator--07832cdc-8e2f-4e2f-9a3b-0f4c7247c613", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--f5d35eb7-cc0e-4fb8-b506-e3663b4fea39", "sighting_of_ref": "indicator--18c90207-0b53-4f0b-933c-e21708ea064f", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--78899800-d7de-471d-a712-990f3195b1a0", "sighting_of_ref": "indicator--2cf962a5-8c73-4188-a53f-6305a50f89ff", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a201173f-4d80-4df9-87dc-bbdfe6cdda4e", "sighting_of_ref": "indicator--3407ca93-7cc5-404f-a373-dbfda031b5e5", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--9f422383-a32c-4715-b48f-34117f580c69", "sighting_of_ref": "indicator--c7d19b36-9215-4a92-82a3-0f503f97cd66", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--1bfcada0-0b53-49ca-8fa2-a244c87ac3b2", "sighting_of_ref": "indicator--3b13acc2-64f9-4917-951d-64bbe99495a6", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--fd0071fd-fde3-41af-9247-fba5ef4b0d4e", "sighting_of_ref": "indicator--98427143-c3f3-49c4-9f74-e59ad6ab2982", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--537dfd2f-f1ec-460b-8875-eb095af4c968", "sighting_of_ref": "indicator--0bbee6cb-fac8-4555-afa9-172ffd387228", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5cd4c400-8078-490a-ad4a-0cb43ab46e0a", "sighting_of_ref": "indicator--2398c7c1-80bc-4fb8-81d7-5c3e4f4decf3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a47e16b2-00ae-46b6-885e-3b46cd6fecf2", "sighting_of_ref": "indicator--c008a04e-8f02-43d9-a942-450668a313b3", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--d064cc88-3bbd-4d63-bde0-77feb5645cb9", "sighting_of_ref": "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e95a71bf-ec8a-4d5d-a37b-71b5ae42e416", "sighting_of_ref": "indicator--d0718acd-ed4c-4340-b84b-9d1edf81dde5", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--477818e6-2b31-4124-8d28-9771447e76cc", "sighting_of_ref": "indicator--2a92483f-d29f-4625-be9d-382b72482551", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--112cb008-5215-4175-897e-9c21ec0b5546", "sighting_of_ref": "indicator--edba19d0-0a6b-48d6-99ad-f67c9bd02afc", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ae1d0543-f011-415a-ad1e-65275f6d4a7c", "sighting_of_ref": "indicator--b8ab7c3a-e267-4ebf-a07a-d981bc4213bb", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--ccc819fc-3c55-4346-8cf4-dfd835341dd1", "sighting_of_ref": "indicator--7d2a6a10-f57b-4eae-b92a-10a85f5c7de0", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--e89ce902-a3f3-48f8-8fd0-9e52865c3059", "sighting_of_ref": "indicator--b3cf9499-4420-4633-a8dd-edc316bca570", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--b76f6769-8af7-4376-83c8-e6d2f4dfb5f0", "sighting_of_ref": "indicator--555b6c4b-3637-4636-964c-a10f6a8b17ac", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--5aab53a6-766d-4f88-acee-2224020f4122", "sighting_of_ref": "indicator--17a03016-96c7-4868-8f42-0aff7da1d0af", "where_sighted_refs": ["location--03af0950-5030-4b13-8b71-7df482530f16"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--da59c197-20a4-4079-9be1-94b35f8aea7f", "sighting_of_ref": "indicator--5a47bed7-e471-462e-a5fe-21b8aa579aee", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--158473cd-0e98-4f5a-9228-ede87c734105", "sighting_of_ref": "indicator--13b6accb-0dd2-4cf3-97f4-e542e6aba82d", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--58d4deec-7d30-4c47-925d-adcf23059f03", "sighting_of_ref": "indicator--2fe0799c-532a-476d-ab1f-0aaea505a24c", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--4bc798ea-eeaf-41f4-8aeb-e8ad9c81f9a8", "sighting_of_ref": "indicator--3655cb23-d494-40a8-9931-cd5078d8e162", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--c9d35eef-9f87-4f07-9e77-e74b52116a36", "sighting_of_ref": "indicator--956144ef-88b6-4bb7-a936-695820882ff5", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--938e14ca-b59b-4ae8-b027-d8044bd3fef6", "sighting_of_ref": "indicator--644e2826-33a5-419b-9861-da2b3613a679", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a024c4f2-b951-44e4-a9bd-d9791ed86a16", "sighting_of_ref": "indicator--bddec6c8-8732-4ad0-8468-090e73f24038", "where_sighted_refs": ["location--b6773cad-9f61-4f46-a3c0-170f379ed49c"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a6f0094a-2725-48d2-a237-b34fb28fb736", "sighting_of_ref": "indicator--2482e7d7-87e0-43b3-ad08-3f1adb1c476b", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--a0972a5d-cca3-4596-97cd-4e992c1af6ea", "sighting_of_ref": "indicator--f5c0d34e-bcb3-4bd6-b9f3-eb4b343deead", "where_sighted_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "sighting", "spec_version": "2.1", "id": "sighting--3dc8d25e-d7ee-40aa-9a38-5b459a07f887", "sighting_of_ref": "indicator--a67728db-4fb7-4e93-aba9-2d60ccf152fd", "where_sighted_refs": ["location--c557d622-0532-4fef-abb9-e1ed0aa25de3"], "first_seen": "2026-10-13T00:00:00.000Z", "last_seen": "2026-10-13T23:59:59.000Z", "count": 1, "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "report", "spec_version": "2.1", "id": "report--41856066-f0c6-428d-b9bd-75dcb70a7eaa", "name": "Threat Report for 2026-10-13", "description": "Daily threat intelligence report — honeypot bruteforce, web exploit, and anonymous proxy detections.", "published": "2026-10-14T11:00:01.614Z", "report_types": ["threat-report"], "object_refs": ["identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "location--c557d622-0532-4fef-abb9-e1ed0aa25de3", "location--03af0950-5030-4b13-8b71-7df482530f16", "location--b6773cad-9f61-4f46-a3c0-170f379ed49c", "infrastructure--4ba1f9aa-20a4-448e-b71d-aeaaf8d6f900", "infrastructure--c5e93506-48a0-4864-80f3-5e534b3f822b", "relationship--1bf9cce4-2e64-45a0-b78d-c232980fef57", "infrastructure--9e78a371-9b3b-43cb-bea4-248f4742aaa9", "infrastructure--c55a0b03-342d-4ce8-9880-e858f441b3e4", "relationship--ab7c6897-c862-40f7-b498-1f7056cfa82a", "infrastructure--c94832fd-b247-4900-b1df-eadc04a9bbcb", "relationship--b0b645b3-4c15-40ad-97a6-4dc95d8c8025", "vulnerability--651e8076-98c7-440a-b8fc-79814d7f4cff", "vulnerability--d4341fb9-f1d6-4e6d-a6a3-f8c5d973a20a", "vulnerability--df0714f3-8905-4b38-81ab-0ec5476291c1", "vulnerability--d8e9d119-209e-4ae8-83ac-92c238b71d00", "vulnerability--843fe0ee-7b7d-47e7-b0d2-fc1c909e7126", "vulnerability--d549694a-c6fa-4092-b7ee-17245cd8929e", "vulnerability--f5843bf2-2eb7-4ebd-89b3-836e825a25c8", "vulnerability--7775b633-cdfe-45c2-946f-408f3bf41f22", "vulnerability--d6ee2fe5-5c0a-4770-924f-1d12250d01bb", "vulnerability--322c2286-6e9c-4af2-ba5f-bf956a058e85", "vulnerability--df006803-2730-4832-af24-801eeaf41481", "attack-pattern--99511f77-aeec-4fe6-b189-8222e03c96ed", "attack-pattern--75015e1c-6cef-4e80-8461-85b937eb111b", "attack-pattern--83fb0379-8510-4a5a-b3dd-0054d9ed0ddf", "attack-pattern--29cd0c28-8ab3-470d-b91d-68ee638f768a", "indicator--3a74cae5-506e-4c96-8a17-e4d5643d42e2", "indicator--8b136fe2-e68b-4081-9ca0-816c315cb9bf", "indicator--273e7123-f0b9-4e62-8c82-aa2762d9e775", "indicator--4a5c9cc6-af8a-4314-a255-8f010b1c77ff", "indicator--c0feb658-de21-4b16-9c29-773550967fa8", "indicator--d5531bfe-66a5-44d1-84c2-d40777ddcef8", "indicator--195f0b17-1ec4-477e-a8a6-14142edb6877", "indicator--f77d30a6-94eb-4198-8723-534b6893c4ad", "indicator--e5de6251-edeb-446e-abca-3fa6dd863713", "indicator--5d09af14-6143-410e-a52e-ab97cb4c614c", "indicator--4f70afcb-1f24-4bd2-85d5-cb071de6dc36", "indicator--5bc067b1-402c-4f2d-a916-e9c9847955e6", "indicator--4077466c-f49f-430c-8eda-67dfdd7368d8", "indicator--e7c9962c-f9cb-4b3e-a4e8-c73b64738ae4", "indicator--636babeb-02c2-4259-a820-9e37c0ff21c1", "indicator--04d20ac8-1bad-45dd-8d13-03ee79d593a1", "indicator--44ccfabc-c895-4da4-97bc-e551f49a639b", "indicator--2b1a3798-0024-4dfd-aba4-6546b9250a7e", "indicator--a4099919-a3b4-41ae-a106-6ef4fa1c612a", "indicator--e67f2e49-b587-4aef-897e-546bf572ab9d", "indicator--ce54219c-952a-423a-b571-9b06b3248104", "indicator--4365f12c-0aa1-4c68-b150-871d8cb89950", "indicator--3a6bcd0a-1c73-4648-98a8-51a2f6de2a63", "indicator--640d2b6a-2061-456b-a04a-015d1fb7da6c", "indicator--5008bbd2-7ec0-4f3d-b84d-ada84e6b433a", "indicator--a4c96478-eff1-44af-9c2c-6543ede82e21", "indicator--5e87f55e-c674-4c44-ad00-d56e4d467227", "indicator--9be30c2b-7189-43e9-94e6-11d5f0acde00", "indicator--7d352620-30b9-495c-8977-20192256aa19", "indicator--f9778319-f61a-402d-84f9-13985cda0183", "indicator--060f28b8-4e27-46c2-a786-a25ddccc2ee7", "indicator--55a62858-5b33-44ae-948b-99da7fbee0af", "indicator--d6cc333e-1163-443a-b58e-832c09faa80f", "indicator--b6a7e2f8-873c-491b-a9e8-bd1e05ebf8d0", "indicator--a3774059-0c0e-4a80-a908-11c9e006a229", "indicator--fed11ab4-5a6a-4d0d-9d6f-0b905cefa2d5", "indicator--9830a89b-100a-4eea-8684-4a91933f1a1f", "indicator--47aa6aff-4edc-41db-86c8-2df9b5697445", "indicator--ec58066b-dc20-4b14-a605-ddbafeb32b0b", "indicator--be968095-4e94-41f6-8770-7893fea617ba", "indicator--3d172290-6155-4beb-9a6c-99adcbcfe363", "indicator--0ea7698d-b5ba-4589-b43c-c1cb648c4268", "indicator--b0b4e2d1-7c98-4668-bb79-0b90f65e95e7", "indicator--6603f939-4053-447b-b194-b15d68da9672", "indicator--f9b9362b-1486-4115-84c3-d70aed1883a8", "indicator--28edb24c-9beb-442f-862f-70747ad2cabc", "indicator--c13ce4a7-9df5-44a6-868a-db83d3d1f6f6", "indicator--101f60e7-bf03-4a82-8b3b-123d2d5199d4", "indicator--56f8510b-d035-45e6-b4fb-c00a70ee7ff4", "indicator--b4fd0d92-fc18-4b7b-8752-e105141c98af", "indicator--150fba5f-61a9-4ba2-a5f5-aeefe8cc28e6", "indicator--995f6651-e714-47ee-8923-817ec092095e", "indicator--c94593ea-040c-49f7-a7b1-1f34eaba823f", "indicator--208e4b96-3d8b-47c5-802a-79d8899106eb", "indicator--7e7a798b-0876-4782-8ded-aa5b813a7e05", "indicator--e732b0c6-dfd2-46c6-8081-1299e323dcea", "indicator--7df08a0c-af0c-4dea-9eab-460444744cb8", "indicator--947eb785-1d18-47d0-8123-096f62a33fef", "indicator--c2774b25-6065-46b1-9357-482c3ebef62c", "indicator--a8f027a3-e671-4ff3-83ef-ebda1a37ed41", "indicator--fd797057-18b8-4566-a53c-6fc8bc1efed2", "indicator--24d68cc7-82e3-4858-a6ac-067218384e86", "indicator--37c08c93-97ec-4559-a053-700f438f7941", "indicator--b9e5fe9b-d036-4fa0-8eaf-435f2934f7f6", "indicator--878d75d4-e32a-44da-9d2d-f92f3e6d8103", "indicator--e2804ee1-a27b-4a86-859f-16d28df05850", "indicator--394ea9ff-562b-4adf-a60a-d6bc24686048", "indicator--16f10b76-7c7a-4074-a825-cf109285ed34", "indicator--ae028069-4a8b-418a-b5ef-bb27879310d9", "indicator--46e16773-17c5-4c5a-8f2f-d998a4357894", "indicator--bedbc3d1-d53e-4011-b1c4-e4d4fe6a5e64", "indicator--069ae35a-de0d-4184-bace-27378d0ca391", "indicator--4bb20872-21ba-498b-a8a1-d6f082a1d993", "indicator--df7de67a-ae46-4ccb-86d1-80a8889aac7f", "indicator--914b596f-248c-4441-a084-4ec9c84e58ca", "indicator--3c0d4c11-57ad-4b9f-9b36-aa5ae0095044", "indicator--e79c3a10-a37e-4cda-a0c8-45b709a4c3eb", "indicator--8e6ac339-cce5-4397-9fed-b960934d6137", "indicator--116f8141-d907-45f9-a4f9-8d89dbd602d6", "indicator--4aae9c7f-dd66-4f91-aaaf-9c95efa5ee4f", "indicator--5a498e58-c999-4809-a4d9-45728a2ebda7", "indicator--575995ea-8a89-4c06-9216-1a57bc050632", "indicator--7e00a9c6-f6a2-4003-a49e-577beca8c1bc", "indicator--0af3d0ad-e563-4c61-9405-a3716341b5f8", "indicator--d4774263-d32f-4006-8f52-b7db7a702c23", "indicator--804b98a3-3d64-4f23-a50b-5e06e71702de", "indicator--cb5d593e-f564-4e32-b6ea-852037dcc196", "indicator--f148ff5c-8b56-469e-92f4-012b66913778", "indicator--87333289-fd9b-41eb-9573-9d6329cb5562", "indicator--9ab9ad7f-c620-4588-9003-8210e201182a", "indicator--1b0354ef-97c4-4369-9a30-898aba142511", "indicator--eb4af4c2-582f-4861-be4c-85a101f37fde", "indicator--0b46a870-2125-4e9f-b18f-b6db8fa65ee6", "indicator--42ae1522-c41e-43cb-bf3e-c1b1e928fd51", "indicator--e1305aa5-a38b-48c9-8141-998ba19968d8", "indicator--43c9f478-176e-4146-814d-a8b9d718d5e0", "indicator--2e576341-4948-4680-b55b-de89a84c92af", "indicator--a4cfa277-8a20-4377-9f1c-412e0d348752", "indicator--cea6b492-9628-4893-9243-de0cb051e54c", "indicator--a5350e89-a24d-4569-aa03-a616e29b9c4b", "indicator--3976900b-ed17-46fe-b1c5-666f45107fd8", "indicator--3d077071-87e6-4328-b252-61233578cde4", "indicator--4f600c33-c7ea-45e1-876b-8d501b4de5cd", "indicator--dbc70084-db50-4d71-9802-dd4a620dd2a2", "indicator--f2bcfb43-ccb7-4f25-ae0a-ddec9e76f749", "indicator--51ff6497-3fde-46bc-9017-994c6b5bf00f", "indicator--306fcf0f-fc71-48d3-bac8-80542e7c5f5e", "indicator--e86c03aa-dba0-471d-9586-be21b5bbb3a4", "indicator--a0a41dcb-2083-44ae-b7a3-81c391d335d0", "indicator--85becc4c-bea9-4401-a53f-be0672045c77", "indicator--52a541fa-fe3c-43e7-bab0-eeb1acd7f7dc", "indicator--10d43822-558e-4ad2-9170-66c2a2cf0d90", "indicator--7a96e625-a0ff-4041-ba9d-e1b89313709a", "indicator--02430407-4b34-4e58-926d-ca0dc4674252", "indicator--8c6fdd56-7ddf-4971-befc-adccd0b4efd1", "indicator--6c4da14e-4e1b-4fce-a631-5f002bae6542", "indicator--9bb86e15-d98f-4759-a73e-9f01ce2cc29d", "indicator--85057e5f-5edc-4c3c-819b-00b838339b6e", "indicator--31d7d101-7e8b-4f45-bdaa-cfb4acdafb93", "indicator--40bd5e29-e4a7-4bdb-93d6-57d213aa6fea", "indicator--e58a67c4-563f-43ec-8bdc-6e9eda38e54f", "indicator--72d3811f-a002-4558-ad57-2ce3aa507485", "indicator--20b674b6-6ddf-48ad-84be-dd991cd9361f", "indicator--0f0d480a-f2f9-4bf0-8317-3cd2316392d9", "indicator--c919347c-debe-4b98-b170-ee3e2e3547f3", "indicator--00594102-c1e0-48d7-8639-1a803e79cb15", "indicator--f78f107d-d6a0-4f0a-ba77-90e5a38d586a", "relationship--e82e1cdc-9c58-44a8-8e71-78eb74cb744c", "relationship--4fcffe14-865b-4bd6-9956-4ba083a347f0", "relationship--fff05ac5-5ea9-470e-b96d-99ef00d576fb", "relationship--30bf3685-43d4-4b39-9c7b-cf62086db180", "relationship--acca84b4-de30-4dda-910c-5a4a2b7d4fe0", "indicator--cb309903-1406-4299-9b87-3f8591800ffe", "indicator--61c7e698-0a99-4044-a4a2-14298a8e15d7", "indicator--f778b41c-e157-4a64-9c69-534431a64a17", "indicator--d8483473-d079-4c31-b79a-5588eed28a86", "indicator--9ea39124-2697-4957-8906-d87138ca97c6", "indicator--acfc7b92-d86b-4b9c-8da8-452cd3654800", "indicator--c003dc98-fb1b-4dfa-874f-f4e4a26ec9b0", "indicator--f43d7178-1e90-49ac-9329-d57256bc84f1", "indicator--ed361539-bcd3-4332-82bc-75ac1a6a6a3a", "indicator--61a7055b-915f-46c8-a267-48818ce2a1bf", "indicator--8da5aafd-df22-4912-80df-d354486333dd", "indicator--9ebb35f3-9d68-4396-bb23-0cad236ef9a3", "indicator--4a9f8fda-406f-47da-b643-5b84ef6529e8", "indicator--e6bcf085-54dc-453e-abc7-9ccfa941e80c", "indicator--2cfa1255-4c04-4fdd-be89-3c839e50637f", "indicator--65f195ba-6a37-43ff-82f1-26fe7832007d", "indicator--5817a2ee-c1fa-45ff-b011-d84d614054c9", "indicator--4bc805f7-7fd1-4c97-a401-285e1e605366", "indicator--fad817b3-8440-4085-b79e-69bc6ee43a39", "indicator--ab9ce3ae-9e2d-45d0-ab94-54675bfc1130", "indicator--e7d2abe8-25f5-42fe-9be4-e2674539471a", "indicator--c5aa6ad7-416c-4551-8d92-9b70da495277", "indicator--342ce6e6-466e-4c96-98b0-cf2f08b15a42", "indicator--44964dff-ce79-4bb7-989b-a1d43127b11b", "indicator--8a6d3129-22ae-42dc-87fb-fe430fb31b1f", "indicator--f28e64fc-be48-4bc4-b32b-615cf9fb2f06", "indicator--3bcccec1-db99-4176-b606-1e885063a293", "indicator--434ba2b0-c93b-4aaa-9d55-4b4e866876eb", "indicator--81a772d1-1268-4ae8-9a78-7c7f9cb9bed9", "indicator--678564d3-0ef1-4679-8278-4fe4cd24638c", "indicator--66c0c1bc-f75b-4ee9-a506-b1028774c5e5", "indicator--b520d1d5-dba3-4867-9a8f-29b3bd759947", "indicator--09b803f2-9c37-4601-8474-9a91aedd70f5", "indicator--a6e88eaf-250b-43a6-b9df-4e4b567a490a", "indicator--e1603b87-f4df-482e-838d-2f482d30fc31", "indicator--7f310315-6815-44de-a9bc-7095e27ddb8a", "indicator--855903c1-ac45-42e9-bdb6-239b9393730e", "indicator--33fb3e0a-4c4a-4202-9d93-3fe761ed8a10", "indicator--5a87082c-447b-4599-8f4d-a05fa32c5174", "indicator--7a45d3db-19ae-4152-a52b-596831b9c1e6", "indicator--50497531-fb82-4caa-9276-8821b9407fa7", "indicator--07da86f9-6db5-4d37-b4b0-9dc4f8645233", "indicator--a89d43a3-3b85-425b-b27f-7a9cc5ead0a3", "indicator--77f68f68-6d0e-46d3-b2f7-566f1f7fe5d2", "indicator--b100af8b-2d7b-4100-be16-f3e0e34e187c", "indicator--5e95041c-bfdc-4cfb-97f1-b42048a15029", "indicator--8b40c548-42c2-4106-b81f-ea4b32754642", "indicator--3daaa307-31c3-400e-912d-20d2bfbe49ab", "indicator--ca634574-4bef-45c5-98af-64026f6f564c", "indicator--79d957c8-eff6-4287-93ec-46b0fcf1655e", "indicator--80e9c055-eb44-4160-8087-b82bcdc9ba27", "indicator--488c2cae-af15-4a8e-b9e8-477862157e36", "indicator--0a45bed6-e969-4785-a704-568262c6674c", "indicator--8f381559-4550-4524-8b82-443dddb49489", "indicator--c52d51a9-b98f-44df-82dd-b8324247896c", "indicator--d72eb688-f5d5-4e19-95f6-06d233247be6", "indicator--4f08fca5-4c0a-4300-ae43-7606a2140da5", "indicator--ad672fbe-7a07-4445-a845-8e87af7a0b11", "indicator--651c0072-2a5e-4569-821c-c4c6bf4aa439", "indicator--84f7ea4c-8c68-4662-8753-aa09df2a95e7", "indicator--1c8e8ed7-b7cd-451e-bc78-2f0e0a1b5133", "indicator--e12ee5ac-9fc8-4721-846f-e23ddfbb8128", "indicator--d208aacc-6226-43a3-bdb1-ebea8e3bac2d", "indicator--968c5d19-657c-43ec-965d-c03b87ebfdee", "indicator--b3e2d12d-f92d-4cad-81fa-61300c7e3784", "indicator--8cfcd0aa-03b5-490b-8fb5-a6a86dc9382d", "indicator--e3b1fed0-7fff-4acf-b409-b76a92e6e1de", "indicator--bca20d22-8fe2-4011-9b0f-02b8c1202779", "indicator--e31702f0-bd21-47b4-94f8-5cc0282ad560", "indicator--5c27fd64-b4cc-45d5-a9b2-205e4ecfe99d", "indicator--8a842af2-3e15-49a4-8f4e-51d985ae995a", "indicator--f57e6002-84de-4742-aced-5082032dcb42", "indicator--42a954d2-483c-495c-b25e-584d74bb9368", "indicator--8dc5ab5c-7717-4058-9d72-c0946fc182c1", "indicator--e85d371e-bc09-49d8-8da0-4f07ae6f1cdc", "indicator--5aff3ef0-a9e9-4c71-9965-8156627d4079", "indicator--fbb85987-3a6b-4fef-95a8-715c1c5f224a", "indicator--c370c95c-32bc-456d-9ace-7c97062cdead", "indicator--980da5aa-578f-4d8b-a14d-904e13daec4a", "indicator--b2cbaee1-922a-4d9c-b707-bb9b0b90039e", "indicator--b14640a1-d3bf-42d9-80e4-661cc921ed9c", "indicator--f547c1c7-68b7-45ac-a736-f34250a99583", "indicator--8c6cff4d-a1bd-4346-9efa-2d9cca4cd496", "relationship--65a2e504-89aa-4c6b-8698-4ce05aab2f78", "relationship--dabd24d4-de43-41fa-aa53-f861dba52b18", "relationship--f915a1ba-5c27-4094-bd38-bd86e6a8e2da", "relationship--9b0ed716-dc78-4015-b4b7-0112cdb29b78", "relationship--05506070-1691-432d-9807-8ce70c09e8c0", "indicator--126db277-ae8e-4d57-9e05-cd88a3571958", "indicator--0f7907d2-2e93-40cb-82d2-d25649def872", "indicator--d1497d46-4c9d-428d-a68e-ef1fc557b4ef", "indicator--3ec677c7-5f10-4e66-976b-05cebf96f874", "indicator--8910027a-696c-4eca-841e-730befd21f3e", "indicator--7d8f05da-397d-46da-801f-71db9939bda5", "indicator--23907188-4730-49db-ab90-8d2709868490", "indicator--e5b4d2df-da0a-4827-99c2-73a24b5011ac", "indicator--a0764500-6e49-465f-9698-1f6ef322ce27", "indicator--1393d870-c9e9-46d8-8e41-12a2563876e4", "indicator--67aca248-87a4-43d8-bfdc-728874be5f10", "indicator--6224fc8b-c82a-43a6-8c5f-e1b3570906d1", "indicator--1a7dae9f-17b5-40a4-9876-f995ea363361", "indicator--5b8b321d-e484-4600-bf9a-d48d402311b5", "indicator--657070b4-397d-4e98-b72b-705ba3b04bc9", "indicator--9b207f68-3b19-49ea-b00b-a545647e4957", "indicator--7b7a0a69-bb6d-4e8e-ba1a-6db670509c7e", "indicator--39c5677f-e948-44ff-8338-3c9314a1b913", "indicator--a54d8449-815c-4f7a-acce-4ba282af1f22", "indicator--5026e69d-6a37-40c3-99b7-08b62f912940", "indicator--27c2e316-47d0-486c-8b14-4a5c2c7ee4bb", "indicator--16766290-9bdf-4191-8034-650fa9ead2bd", "indicator--ff56e529-d5da-4840-a736-5104e8fd5208", "indicator--45dfc365-9d0f-4c1f-8011-2c9b4e8b2b47", "indicator--e306a9dc-84bf-4f38-a5e4-4b73d9bb76a6", "indicator--d5b040d5-2a93-4d38-903e-a7e8c3207573", "indicator--f18a88e8-39c7-4249-82bb-a7b5df11996e", "indicator--461930ea-ca9b-44cc-8c58-cc804b3f6a67", "indicator--acaf5527-9440-4202-aad5-d531c961f4fa", "indicator--63d53d55-99e1-4905-bd0a-4b30fa1b0277", "indicator--e9752a97-540f-49cb-928e-bc592e4e9d51", "indicator--5bce037d-59d7-43e5-934f-d756f28195c4", "indicator--47fd7bfc-a441-4090-87eb-07556c4209ef", "indicator--aa4534f5-f8bb-4b04-afbe-4528c2b0062a", "indicator--429717a7-ab7d-4ce6-ab12-fdf3d8fe03b1", "indicator--551ac5b1-82ed-4c84-8007-bcde22f32d92", "indicator--4bf3dcf0-605f-43b6-a700-385984a7a9c1", "indicator--6599fd2c-8672-4fdc-b371-f316196adc84", "indicator--69a04413-5168-4a8d-8761-79014ee34172", "indicator--b517ff0e-c353-49ae-bddc-cac1546f57e7", "indicator--8c91fce9-f20f-4b34-ab24-5004320f2cde", "indicator--665d24cb-2198-4dce-b343-dad6f5f279b6", "indicator--3de14aba-6269-475e-b6a2-59117dd799ad", "indicator--46b7950f-d0c7-47a7-9e0b-29f11d064dde", "indicator--98483eaa-8e3a-4d78-9a08-6c9a76664488", "indicator--c208b9c5-b612-42a0-a7d0-c27ed1f74e92", "indicator--7b80a301-66aa-4c9e-8b50-26f7984fdcb8", "indicator--bf7bb648-e361-4186-a076-7b6b93a3a1c8", "indicator--58333ea5-c5b8-4e20-8fba-267448d1e2d0", "indicator--bd5219bb-6c87-43a8-806c-5dbdfdaa52b8", "indicator--8819582a-62b7-442a-8590-67482709fe50", "indicator--524fb734-c971-4324-8ef9-1e9d47e16ced", "indicator--988f5766-e8e0-4f60-b16f-9a29e2e8d45d", "indicator--185f4804-8670-49d8-a760-cf5fa63daa7c", "indicator--977db1a7-1767-46d9-9829-4ad45b37b4c2", "indicator--eaed0d98-4bb3-4a14-a1ba-7f145d2eadcd", "indicator--2998e7cf-bcb0-422b-a20a-753d7f74125d", "indicator--31be4430-4984-4d0a-bdf2-da2cd311445d", "indicator--696f57e4-838b-4129-8500-a467cb53b265", "indicator--50fc2034-1428-45c5-9391-904634e7c3cc", "indicator--406da5ba-6cf2-42b3-aea6-5d722e100e55", "indicator--4f5e81d4-ab76-4f8b-ad3f-b58fe27c4dd3", "indicator--4d7cff78-6331-46da-9d46-c5ff833570cf", "indicator--e2540a95-5917-491f-9e1f-55ddc3b79f14", "indicator--b46d2760-ff59-4687-b364-bc112ff6e1ee", "indicator--21acc475-f47d-43b6-bc43-2dccf7abebeb", "indicator--27d5de8d-5fc7-4b3e-9647-0518359db66a", "indicator--67fb807f-0acf-40dc-a411-c38fef14330c", "indicator--0960fd7d-2d52-4915-8d1b-d7f72c6ef12b", "indicator--83334a29-9bb5-4089-8d19-48ebd5121e6c", "indicator--937933c8-9e48-46f7-b721-16be3e87c255", "indicator--e57a054b-37b5-456f-aa6a-7c96e6171c90", "indicator--94a6fee9-7497-4b15-b5b5-7158c43d06cc", "indicator--8b19fb5a-4a85-466c-9be5-efcd4033a53e", "indicator--d2d16407-4d01-47a9-909e-d29b4297b1fa", "indicator--50871110-4dfe-4ec0-8691-52949440cf9e", "indicator--fbbd0b92-1213-4196-bac9-9a543c024494", "relationship--93b87449-62e2-4cdd-b6af-a96bdfe2c721", "relationship--0d255a2c-0208-43cf-93d2-2fc10b650a1b", "relationship--6990e2ac-62f5-4d2f-bcf1-1c18131ce852", "relationship--8b74761a-3bb1-4a76-b316-dfd60f75c2dc", "relationship--bb385d88-1b9f-4e5a-9700-2e91f5e9cde9", "relationship--9e44fada-8530-477f-8a86-a534994e438d", "indicator--826b6d4b-e331-4a04-b2d3-8de03c432133", "indicator--b6e01fbe-691c-46b3-aff4-88c728dea23a", "indicator--09db3873-8b5e-4bf8-995e-395aebd4173f", "indicator--4471c899-bda7-4693-9e70-40fa6b469bc1", "indicator--6aff245e-8fd0-4c5e-99c7-14e6ef9d4907", "indicator--009a3e03-1cf9-4c5f-a3f2-73c3b5005a95", "indicator--5e626783-2bf5-4f7f-a7e9-351ceff76437", "indicator--73d66a66-0e83-4a5c-95cd-2ebd4c04a896", "indicator--4fe1f7ee-3b05-4b87-b25e-723e33544969", "indicator--f7b9070c-500f-4c76-9eb2-c8474a5cf8ad", "indicator--38f5816f-e79d-4ada-8f39-9f756c640a14", "indicator--f2e8f212-7ab4-4579-a18a-1ee7d83effad", "indicator--70173015-c7b6-4470-9ede-5b712aad4bd5", "indicator--d07bf895-4245-448d-a4cb-f985d188e694", "indicator--0f7dabed-c1fa-4dd4-82a1-b4cdb629a69b", "indicator--4f727f23-1c17-4c5c-817b-83f66a15025c", "indicator--7590c99e-f834-4dd1-8c83-889eb9b0ca41", "indicator--c5c39fd2-ea23-48a3-a4ef-2a650f951f58", "indicator--c206e6c7-86a2-4f4b-872c-6970aed8c8f9", "indicator--94b7bfa6-3c30-414f-9fa2-f2ab64eb7a61", "indicator--84172eb3-7913-40cc-8e32-61d1467bbaa3", "indicator--cacdeee8-d757-4de9-97f9-99899a8b71be", "indicator--18b54e55-ce1c-405d-9b63-4e255521a0d1", "indicator--7eb59dde-a398-4fc9-b57c-6cd81e760095", "indicator--5ad77923-a3d7-4ecb-bc49-cbeb347dddb5", "indicator--1cbe66b7-7e6d-4fc9-84f8-2e2b1215cb87", "indicator--a3ae951c-2274-4f32-90ed-df19d9582074", "indicator--a66913cf-8ba8-43af-9527-db8f1fcc1e69", "indicator--db472915-08de-4159-8756-64b9bc86b3f4", "indicator--0d080449-e633-427d-b18a-18219cfad53b", "indicator--5b5e2316-addf-4a9f-b672-309337f495c8", "indicator--43e9f214-33f9-4262-985a-16dc92031e35", "indicator--732de872-10ef-4140-abe3-3c16ab1a9d86", "indicator--90666c3b-b049-41e0-9063-13cb4b45e1f2", "indicator--90883b61-e84c-4679-900e-3a2efbb84c13", "indicator--2ceedd6d-1a46-4e71-b685-4584e2c9656c", "indicator--529157ff-30ad-4626-9d44-f2bdef1f68b5", "indicator--dd43d4fa-df59-4fdc-ac11-f6921d80861b", "indicator--4d515786-7b9d-4244-b62f-ceb5c5b71209", "indicator--6ae59f34-df85-4ec2-9194-e0ae2d5d5010", "indicator--d55ba044-eec5-4e30-8c2a-25ce68ec92e6", "indicator--d69818ef-99e5-487b-9230-98ae0a0d3cd5", "indicator--b5810bc9-3269-4793-b43b-ec34efa48c37", "indicator--6d7ccd44-4d65-4a35-b6af-3ce05371e626", "indicator--812c7ad6-b3ae-4183-a50d-bc71c02fc478", "indicator--82ac118e-95f1-436c-aa0a-bba96ef03e2d", "indicator--7285a19c-36ba-4b46-871d-1d1524492324", "indicator--d2a1be4b-3bbf-4e00-b4d0-a6bff8f3b4c5", "indicator--04cebaf5-4dc4-4b7d-b3ae-6ef73ae14dcb", "indicator--c6295cec-ff0f-470c-9915-a73150b86651", "indicator--18f9475f-3b99-4f60-9683-05747b86d9a9", "indicator--9211f655-9e53-41cf-9eef-5c65a38fcade", "indicator--17c4c75f-594c-42aa-b292-753855fe909e", "indicator--47c128fb-8c51-47b7-aee3-cd99373712f7", "indicator--b257449f-281f-49df-8491-aa8ec891ff98", "indicator--c65342ac-3d67-47ab-836f-9c36ce41c150", "indicator--daa83822-5d9f-45f6-a800-c46993ba0b6d", "indicator--baa4f134-729d-4a23-ae16-3a2ff1f12c46", "indicator--3a044fa2-3443-485f-a7c3-229bb713b51b", "indicator--a5715452-ad8c-4f29-aef6-6f4fcfbee152", "indicator--4fa8fd05-7e6f-4b56-ac4a-4334ff223008", "indicator--b1af725e-aab7-4e43-82b3-a76527c75a6b", "indicator--f56d2c13-7abb-4187-9053-7dcddd11c6f7", "indicator--b06a0f2e-d7ef-4cd9-a48b-eb4cd8af675d", "indicator--084aed92-5f3a-4639-9e31-6d0c2d69eddf", "indicator--68666e48-247b-4237-b497-b0990729fdc2", "indicator--c52b430b-d4dc-46bf-b43f-d707634d380f", "indicator--c634b3fb-a50a-481f-8068-6d22f80e3dc7", "indicator--26917cd4-3623-43fb-9562-e7947f2c3e67", "indicator--2dc0afcc-f2c3-49fb-a046-824c6e64cd3c", "indicator--8066290f-e85a-4631-8618-e40a55ceb898", "indicator--b48fa6bd-4829-419b-81a4-83c000fd6f93", "indicator--7baddb64-f99f-4d3b-94c7-384e2f869d40", "indicator--2d4d94bd-7104-4019-b258-720dbd429a37", "indicator--e7ec6fa4-9668-42d3-9f27-dd525775362e", "indicator--22648ae2-9a83-4940-8e8d-f513ddeb0d46", "indicator--f62320a2-8fa1-4823-9dab-041cd0f85a22", "indicator--486d1c34-119b-43dd-b488-9695c94fba24", "indicator--8a954dd9-ea60-490c-8055-96fc4c80b60f", "indicator--3c7aef50-9a34-4f3b-95ab-1613efd8e769", "indicator--071edd58-75cd-41f2-9163-c4b389b6298a", "indicator--411dd63f-eb34-4472-8e35-01e3179c9984", "indicator--2e4caeea-57e3-4520-83ff-0eaa5accb2a1", "indicator--07931124-c727-43bf-a2cb-46ac892ff0db", "indicator--72d3ed44-ba41-4b81-a4d7-28fd8a9de533", "indicator--52ae2111-d7b8-47b8-a28e-3f18256de9fb", "indicator--116b8957-8768-4da4-93e4-89a562f56e99", "indicator--8d1964c5-285b-4fed-a8db-37428283b54f", "indicator--3fdb5c11-190a-4090-aac4-61b0b4bc3f27", "indicator--08636220-29d3-46d1-8cdc-8f129a21f9e1", "indicator--425bd389-9061-443c-b5fb-1857a696e439", "indicator--04680b14-6454-46e7-b8d1-8c285e7b9313", "indicator--a7207025-0835-466f-a7b8-2ff5c9a7dead", "indicator--d43ac9ac-8658-46d7-9a1e-5cd913e8bbee", "relationship--6f105968-9a56-407d-8d3c-0ee89338d437", "indicator--7bfc4f8d-a650-4eff-a238-ace121ad082a", "indicator--9cbf232a-ef37-43fa-8fc1-6caabce829d5", "indicator--36f89662-abba-4980-adf6-3875fe124622", "indicator--3dbb140f-4e80-4ded-9488-fd486f8e34f7", "indicator--f106bc73-c37a-47db-b823-6048b37d9a14", "indicator--cef7b58a-dfd3-4a02-91bd-78ece5db9c5a", "indicator--7d951e32-ec8f-466d-9b8f-bcf245dfea0c", "indicator--c80ef41b-40e0-4902-99fd-5d037a9d6506", "indicator--6d795f95-8470-4ee3-b037-3b0f35d1429d", "indicator--a4a92c75-51ed-4a80-80de-34793c6467a0", "indicator--d7ba19b6-69cb-4b90-97d1-71d1e8051739", "indicator--f2a7e472-f78b-4d13-b493-b485e8b83a17", "indicator--b4cda637-6785-4451-b47e-18eee23a8bab", "indicator--21686ecf-29e5-49af-82e4-770e51b5d3f1", "indicator--6b316a8a-098f-4c88-bdd9-3ae5f2e30c8f", "indicator--f290b38c-a4a1-468f-b3fe-b3cd0acafa6a", "indicator--fbef1ea6-7d58-4b66-a7d6-acd2d5f9c241", "indicator--d59ba85b-26aa-4b58-8bdc-b4aed31d151c", "indicator--260f3a81-3084-4c5e-900b-bf1baf5d6711", "indicator--e2134989-a2c0-4638-ae15-b9d3dd7057dc", "indicator--eb889dde-d061-453c-9230-589eb7eccf32", "indicator--843f3b95-5a63-4906-83bf-f147e673e299", "indicator--70ef770f-71ae-4638-b9fb-2c5b5c79f7d3", "indicator--b7beb7e7-967c-4192-b07d-fd779e469d15", "indicator--799e3f38-b113-4861-a36b-73bd1167c9b4", "indicator--093cad4d-df9c-477d-bdab-1677c797de15", "indicator--1a0c0776-482b-44c8-94a0-6a61c9e27d2a", "indicator--77c2f315-8e4d-428f-a10b-1854989536af", "indicator--356ea295-78e8-4122-902c-8c66fe42346a", "indicator--c2ed4a39-3850-401c-a9bf-a2710f362045", "indicator--cd812dd6-4483-4b7c-9207-bbcf16555f63", "indicator--597c570e-edd8-4098-a995-2bd8c5098a14", "indicator--586404df-4765-45ff-a25f-ae2861650227", "indicator--7acc450d-c557-4d73-b7a6-1265f1726fb6", "indicator--6c6b98af-062b-4caf-ac3f-bd1218cd8d66", "indicator--3ec159ae-5007-4947-9dc3-969b103701f3", "indicator--84abb3e0-3cf2-42c5-a068-5cb98837ebeb", "indicator--80d12be7-4cc1-4aa1-aae0-298d123ec968", "indicator--b17668d8-aff5-4edc-867b-65cabbae1b50", "indicator--a5845a0a-df54-4a3f-bfdf-39009d987cad", "indicator--398f011f-0f39-465d-bf73-9784b13cab12", "indicator--b485ebbf-45c4-4a03-bf46-b86e2e132dda", "indicator--4fd0b9ce-d1bc-4bdf-9c96-bf704046b32a", "indicator--0d726644-32c8-49aa-9217-52b57c9f1a45", "indicator--4021bbab-d2d7-45a2-9582-939555907662", "indicator--b28747a4-44db-43f0-937d-cdbf67419267", "indicator--a18f0585-dd3a-4fcc-9dfc-ab5f223fae59", "indicator--4e99b561-62ff-4029-a0b4-8a1e4656896d", "indicator--509e9433-e13c-4d39-a717-c2f9f97f5957", "indicator--75746bd1-2f1a-4e66-9f69-051b935110c9", "indicator--5672748c-27e7-4c95-bbf9-306e656ffdc1", "indicator--8308c08d-8aea-4c7e-81f9-b59a3c6e0721", "indicator--ed4a92bb-eefe-4956-8d23-a52d72b67861", "indicator--d1f2cc5c-383e-40f1-9794-8bfa7dd161bb", "indicator--69aeca51-eef9-424f-bb40-cec720af70a9", "indicator--769678ee-b651-4e3e-b371-1c7f795891d6", "indicator--d4ffbb29-f6c4-4c2e-bee5-197fce65bc7a", "indicator--8b4fed2d-3980-403b-b03b-0e438be215cc", "indicator--37cce0ba-1c56-4082-a93f-875648a37dff", "indicator--e1b5deec-640b-4b28-804c-d38dd5eddfdc", "indicator--5bffb3c6-2ca7-47c5-9937-7137a513c1c1", "indicator--b4f76813-0723-4162-a504-4f304d7f8f1a", "indicator--7a8b9c1a-e3d2-4614-80a6-0aa1b18c36fc", "indicator--cdfb32f4-b237-412a-97f7-601f8b562f64", "indicator--e2056ac4-4b3f-415c-8531-35f1233a41a4", "indicator--7163f7fd-f22d-4956-9193-ec1ceffd87b5", "indicator--7f23633e-e88a-4838-8aa0-e72463470b99", "indicator--1f8efa70-f499-4c1e-8c35-f082d49a95d6", "indicator--84233355-a75d-4a98-9f63-3b6c91f86865", "indicator--ec1ca6bb-2dcb-4dc7-9c19-e158ef44ef62", "indicator--182d00fa-bd0b-4ae3-89a6-7250e84276b6", "indicator--887d0429-a8e8-4fb8-9ff7-fd19517c7f94", "indicator--369b3be1-37d1-4388-9cf8-d4b36417ce7f", "indicator--3ffc370c-b692-48a5-9156-079a1123b6cf", "indicator--686d8680-0ae2-4e79-8250-9f086c452311", "indicator--16e37d16-7a00-46b0-ab38-72b8cab00f60", "indicator--c0925c93-3f39-4301-b2d7-08e2252ef7d6", "indicator--50729ce8-8229-4031-a523-b2f9c87f8e25", "indicator--baf99a4a-4385-459e-bbb1-b58b7c4a08e2", "indicator--611c102d-8c93-41e7-a00f-25bc0ddd5d28", "indicator--cd689873-a3cf-42ba-96fe-dd48cb4b874d", "indicator--cfc1aecb-4463-437b-82ad-bc82d941654f", "indicator--d2776772-4046-4a91-a380-12654c82d09a", "indicator--721f2807-16e2-47a8-aa1f-44ba0d1ecb9d", "indicator--0292e112-6915-45c7-bca9-efc4e1e6f182", "indicator--76afe323-30fa-4b90-b63d-420c73619d61", "indicator--fcbe4c9b-1ce6-4d76-bebc-1ef705bda4c4", "indicator--c5a942b8-9f5f-4656-92ce-a121353fa3aa", "indicator--19ec4e89-dda5-4f1a-a6ba-82a0e391d2e9", "indicator--aea54850-53fa-496d-b88d-28eb305ee753", "indicator--c534da93-c86d-47c6-be40-b7a260ff7e95", "indicator--9ac88495-543c-4e90-984e-06e889f4fee9", "indicator--a872e593-4d7c-4f80-9723-c5f077928cae", "indicator--f2b358ac-211f-4f23-8419-e74e07db78c4", "indicator--eb865dda-b248-4820-98e3-98d7f816eb5e", "indicator--534dc469-458f-4cd4-82a0-7ff9bab168df", "indicator--9fb70dff-9da7-498e-9557-76d59e26d492", "indicator--d2b073b0-4953-432b-b968-463b3cffde5c", "indicator--84254c35-f752-4ccc-bd8a-cec79b32290d", "indicator--fc23236d-72cd-4823-9343-f8ef6ff23960", "indicator--386d3a72-ccb2-4752-bd4d-2fae4438f094", "indicator--90690d02-8703-4ddc-a517-72dc60c312fb", "indicator--2fbd6489-d5e5-466b-9a54-97ca12b33203", "indicator--1db6f4bd-1c21-46f4-829c-45a0f75a6b21", "indicator--ac856420-c77f-417e-a708-231727353737", "indicator--b0bd9736-7e6c-42b4-b32a-bb28cc4790d1", "indicator--fe0402eb-1ab8-423e-b9fa-7f25d22f50b8", "indicator--aeea3051-7011-4706-80cb-7da1fe18f08e", "indicator--50d2f585-3842-4d32-8168-5aad96b0a41a", "indicator--0a776d36-c4bb-49c0-a277-6b37ff61f07d", "indicator--288b3009-73a7-4424-aee8-b823e182502b", "indicator--19ff8dff-b856-44e3-9f00-356ed948c2d2", "indicator--190c9398-9d2b-4aee-88bd-c8124bb2471e", "indicator--eab291df-4b24-4ecc-8481-2ce4528e5651", "indicator--5b023cb6-5182-436c-927e-e94e7f2ebe14", "indicator--65bfa71d-ea89-444b-9bf5-c85cfdee08e8", "indicator--a0dd068c-352a-4dc4-9fc8-09019fdec073", "indicator--9e56f49d-5ce2-497a-ad14-876c59b13764", "indicator--0bba406e-5d4f-446e-9cad-c43898f5ac17", "indicator--f684d946-3f19-42c6-b85d-a3c5d570ffa1", "indicator--e545845e-48c0-4ef7-ba6f-11d5a687efd4", "indicator--3832eef4-ec55-46a5-9047-987f7a82a757", "indicator--ae1d8f1a-880c-4fac-aaac-d31393f808e1", "indicator--b86be82c-802f-4a7d-aff5-1f30dc4f4b15", "relationship--332012ee-39d2-4716-8911-68f9a187ca70", "relationship--19578386-3ea1-4eb5-99bf-057947a513ed", "relationship--df4bdd76-5094-40c3-90e7-10ecbdf2bd98", "relationship--2a43ee18-2180-4930-9bef-aabc9f44516d", "relationship--152c73c1-0fa3-4350-bb45-5c8feab9dcee", "indicator--73c2b156-2f29-46ff-b63f-99fc5b27d11d", "indicator--b06db96d-da92-457e-aed4-f9bb29fbd266", "indicator--d072745a-8fe2-43b2-ae26-31b10babaac6", "indicator--023cf868-8a47-474c-9c02-257fa783f2b8", "indicator--1c309ffa-6241-4809-8bb5-d6417cf28ed4", "relationship--0cdf84f7-6fc9-4ae6-928f-5abf4759f573", "indicator--a358c003-6737-477a-8e53-896618597747", "indicator--21edc03e-54da-499f-96dc-21b93338ac0c", "indicator--eaa2944c-1caa-4e2d-852f-e7ba5ac30cf1", "indicator--db9a610d-b6e0-46aa-a73b-fcaff56870bf", "indicator--1254d587-f0ae-430b-844b-4b2c95b7acdf", "relationship--aca25829-bc56-46fb-b377-b4196b7fb1e4", "indicator--741b1744-5965-4ed0-9a37-6ddfd842ecbe", "relationship--e034dfbc-00a1-4ba4-ab90-d70b3933d4fc", "relationship--0ad2a583-a9ad-408a-b46e-96959a29eb31", "relationship--32eca5d6-5c11-486e-8935-6fb3e1067300", "indicator--c123d669-042c-4936-81df-4e14a128365d", "indicator--d4766fd9-41c7-490d-a72d-55235eda3958", "indicator--07f0c669-316a-4aa1-bb00-b95768811d93", "indicator--50b9f4be-7302-45fc-a14f-642978bf2027", "indicator--c4c2704c-54de-4fee-a409-646140535e81", "indicator--5f1d1544-c2b3-43cb-89d4-a6b1d5b731e3", "indicator--93ed3ef4-9226-44db-b876-63dbe2eb7894", "indicator--59b929b7-d2d1-4f05-90ce-b71c663a8237", "indicator--13ee6305-168f-4aec-b3a7-d1d933f064b9", "indicator--6e40fecd-9f8c-4d22-bc74-fc5f88e00928", "indicator--87ad1cbb-5227-4d04-96a7-e74702212566", "indicator--a6617dac-1c4c-4cab-9f1a-715ea5068718", "indicator--3f97f9e7-8042-431b-a0a9-f8de063692f2", "indicator--890d14e0-8d32-45cb-9c9d-b332a8e5e671", "indicator--6cc706c8-5ca6-4fdf-9110-c899a50a1566", "indicator--2673a2b3-578c-4a6d-8e04-af696ecaef37", "indicator--4476c976-8b74-4b2f-a801-ca3a28af9f9c", "indicator--740ad783-fec4-42c5-a8b8-d9189cd26acc", "indicator--b37c6376-6ca6-479f-93dd-c15f786f5086", "indicator--0637a308-7a0c-4e4c-9bb7-279883a9fc95", "indicator--6ebde14a-dadb-4d42-b6df-db056dee9979", "indicator--1bed0d7b-b04f-4d12-8af6-b563a0f5d5f6", "indicator--e7e7faf2-7a14-4caf-883f-7ebfd1b7918e", "relationship--a06cc7f2-4969-471c-8f0f-d25810a584a1", "relationship--f6ae40f3-521d-48a8-8f25-4c1b9e0bd170", "indicator--b78d273e-ff4a-4814-8109-d5dc39149a45", "indicator--360827d9-a1bc-496f-824c-2343004ad3ac", "indicator--2d5771fc-44f4-4c0a-8517-5c3cc310e48e", "indicator--42adb5ea-7539-4dc5-bad3-3c987e30a8ac", "indicator--dd9ec39a-a67d-4490-b37a-95006d1df557", "indicator--a1b7456a-c58b-47bf-818c-42c8faefedb4", "relationship--ff29cf4c-995e-44e4-bf1e-6dc9702f2782", "relationship--917593c7-7455-42e1-ad1d-4d8e6336c842", "relationship--d66f2bbe-736b-4187-8abb-082135e56f62", "relationship--2d1ff4b7-0902-4618-a253-bb604cd916ec", "indicator--178cf3f6-6e42-4501-b526-7cfa46ae310c", "indicator--1655882c-868f-4943-83bd-7372752e7288", "relationship--4860c08d-1503-4688-8150-e181b439cf89", "relationship--7e4c13f5-45cf-487d-820d-2f458b1c89d4", "indicator--58541032-4959-476d-b82c-38ee0faf3025", "relationship--ba9a1048-8e32-4e94-9792-648683a62fed", "relationship--cae963ed-084a-4e2e-b7fc-0eb194bf45c8", "indicator--cf1e979a-12f6-4608-8e3c-a976cc081d4a", "indicator--fbfb3ffa-05f3-42b0-b94a-cadff01a7af5", "indicator--547bcc62-920b-4e28-afcd-69b33f0a244a", "indicator--d5711312-f52d-438f-957b-cd32124ca8f2", "relationship--8b8999b1-2a9b-4b97-b76c-3fa3a3f3bce9", "relationship--47e225e2-772f-43ac-badb-97c845e503f3", "relationship--9ef2fa18-4c4b-40b8-8f9d-f705ff94f9ad", "relationship--12fbfabf-ff76-40a1-93ff-d35af1e7964a", "indicator--31a95f5a-36d0-4757-9097-4432cdd1851e", "relationship--9f220a89-148a-4140-ae67-9b04fdc1156d", "relationship--c5097379-dfa1-42e6-88a0-761ccb568072", "relationship--cf724f4f-664e-402f-8d5f-4c8c29eec402", "relationship--a08fc99e-080f-4076-bd8b-c629a170f75f", "indicator--7515966b-06f2-4d81-8135-951e7889cd26", "indicator--7ce0ffe1-1d9a-48a0-8554-ab23ef31b963", "indicator--b8140110-e720-4eb1-9703-767b5f84d4d4", "indicator--66d9ffef-1f14-4cf3-a996-6d8dc20f3e27", "relationship--fa5c4ebf-971a-496a-8f40-f16ee138bac4", "relationship--7d1a1a9a-85d3-4643-8980-cb08bd500ad5", "relationship--ce6df222-08ef-4da4-8d84-44821c79e02b", "indicator--7ceaff6e-7756-4f5f-a8f5-33a9b635a043", "relationship--7c26f52b-4098-45be-9fb2-83beee074afc", "relationship--c4bf31f1-0e7e-405b-9b04-336308c5ac51", "indicator--51be5e1c-9e84-4ab5-b2b1-7a04a1d5195e", "indicator--68f2ee9e-197c-43d3-afd1-7e542fd51033", "indicator--8a5af7b0-1616-42b5-93b8-8afad06385c3", "relationship--689c01dc-e656-4c85-8aa8-c4d49432382d", "relationship--23c91fbb-57b1-4a94-aa04-07263e9f2924", "indicator--8390727b-554a-4c1c-b951-5c1b7c0ffb35", "relationship--20147d54-0dbe-4021-8c84-abf7851cb1b3", "relationship--b7b1e67d-662b-4352-be74-ca706ad34a62", "indicator--35aef63f-394e-4f69-8cb7-67cc9633fd43", "indicator--9fc34150-7f45-4ced-9539-dae6b6901bfc", "relationship--6db303c8-2e32-438f-9803-30b5e493f807", "relationship--be48fe54-f931-46bf-81c5-8b54eb3f0b18", "indicator--735eeab9-8ec2-4e82-9d94-855502f0efd7", "relationship--c1197df4-f2ea-45b6-9995-0419cbfd0b7f", "relationship--dbd1a7af-e8dc-4bf8-ab9d-8d9128781cb1", "indicator--f328fcd9-2521-4eae-af25-b0151bf41042", "indicator--5d126d73-4a15-48f7-848e-36636b7ebf41", "relationship--5e6c6b8a-f963-47f3-851e-ed606f0b5842", "relationship--e71d180c-eef7-4ce8-88c2-f82d48b50ff9", "indicator--c17d68ff-d5ad-4340-9d28-21f8ab8d0d6a", "relationship--f25d7a40-a7ab-49be-a40b-79ef1e6b2d13", "relationship--68da206b-3cac-4b9f-a081-d209b6fda306", "indicator--c7066b16-ad4e-4c09-86b7-c6ead8150471", "relationship--9c66e7bd-920f-4af2-a8aa-ced872de6ad9", "relationship--0d8ee335-5da5-4ed8-8262-878581161065", "indicator--e1b5593f-ae26-4a03-a4c6-1138f67981a7", "indicator--b2770602-8163-4d16-a16d-f120200af410", "indicator--1621d255-01b4-4098-8527-6bbbec9c424a", "indicator--cb485a3a-b973-4692-be52-c4e13ba3ed0b", "relationship--f269bc17-599f-433a-8a20-f994f3b452a7", "relationship--3beab13c-1c64-47c2-b22c-59835582c1bf", "relationship--8607ba31-d569-4591-88d6-cf76c3a8559c", "relationship--f1a3da37-e878-4649-bb3c-aff5cff88957", "indicator--b77cabdd-ba14-4c40-b473-3fee5ed0d05f", "relationship--5ae1511e-98ce-46c5-8129-a21be2775618", "relationship--6aab624a-29cd-497e-9c07-b4aecd9fff84", "relationship--cf87f806-e492-42ad-8505-d3c6a77b3e3f", "relationship--b5cf7bbb-5ebf-4f0b-936f-30a97c5a2255", "indicator--46b6ef10-b478-4ee7-ac64-e97a504189d5", "indicator--f5f5db75-b1a3-4542-804a-aa51c6bd0a0d", "indicator--6af2ac07-2f48-43dc-8ecd-cf70d0892789", "relationship--0d46f7d4-7f24-492f-8c5c-529636dc4031", "relationship--25890efb-76c3-44d0-94af-6c491f81e732", "indicator--9d22484c-e0dd-4545-9507-45a4009810a7", "indicator--66f202be-f2e8-40d4-be62-08c588d3e6fc", "indicator--7599deaa-d422-4c05-8c5a-fbf676596630", "indicator--58db17c1-c2cc-4491-8da5-0098e6f44e09", "indicator--da3d9de0-86a4-4a39-aac0-f5c913fac09f", "indicator--fdfe5627-d400-4717-b17f-61590d22446f", "indicator--080bd13f-da31-439c-b556-5ca730c131e5", "indicator--b9fa9e78-22e8-465d-8bc9-51f6127aea0c", "indicator--25894873-71b3-47b3-8547-8aa1e6a9f78f", "indicator--507e18a0-2161-4b86-b2ff-eeacf3dcb535", "indicator--73271101-dd9a-4852-9334-c0c1404efc73", "indicator--99faea7d-4f14-49cb-8036-9af0cfa45758", "indicator--e658ed1c-7ab2-4e15-a55a-93318f30b5ec", "indicator--f4d96f60-45d2-4d08-9f35-1a9376954402", "indicator--939dea73-b6fc-4574-9ba5-209905d5d593", "indicator--3b414e38-c903-45d4-9976-514a49493bbc", "indicator--23eddfd7-1fdc-44d3-9661-7f14002bf0f4", "indicator--2597b68d-8a46-4ea1-8798-3e1b78a6efa3", "indicator--1e0dbb32-219b-4990-9d4d-8a853f7dca34", "indicator--430e8804-5138-47a4-b509-8bc5bb3103fb", "indicator--bf6a1660-36fd-42d7-b705-01b0a804cb09", "indicator--bacab76e-ced3-48ff-b68c-22aa6a5bb461", "indicator--8cef6713-ad93-4ddc-8094-4d183b231368", "indicator--54079409-30ba-420c-b985-b8d871e97459", "relationship--bf8674e8-00af-43e1-a772-bb18fce3000f", "relationship--948cc627-5f28-4a31-ba2f-bf84b8594ca3", "relationship--23788369-a156-4a56-a68f-940dbc772190", "indicator--9b594dbd-5924-4be6-92f4-7a99621b4457", "indicator--94d2af3c-c514-40ce-9dbd-85b83bb0f29c", "indicator--e553dd73-7d84-4237-9481-1afaa47babfc", "indicator--edfff737-6756-404d-9bd9-bf1e963c8ece", "indicator--229559f2-926f-451d-98b0-5f0fac7372b9", "indicator--992d74d9-d361-42e9-9fbf-d0d8b2cd8447", "indicator--07b93556-87a2-43a3-ad92-e22996903482", "indicator--ac21299b-0066-4e86-88e9-086ac7e102ef", "indicator--52cec7dd-2bcb-491e-bbef-2b6b019ee711", "indicator--028ed57b-6e04-431f-98b1-cd338eb1d2b2", "indicator--8b2dec90-e9c6-4370-b252-30b684fd82f0", "indicator--d61f7ed0-f2ad-4ee2-97d8-8efa4cddc161", "indicator--ba3efea5-59d0-4038-b7fa-eff25eba7f5a", "indicator--12611314-e67f-4642-a163-3b8c3b88fea1", "indicator--91a1ba40-605c-4c3d-97b7-2bcff97b7f1e", "indicator--9ea17cd0-e29c-4653-94e9-ec46b6fcdd58", "indicator--89b30f12-ee4f-4a2f-b37e-18222a4807ed", "indicator--b2ba8caf-a856-42dd-a8da-1d2772065dae", "indicator--b9465d33-3788-4d90-8c23-b34a8baeed7d", "indicator--d87eb18d-d8e7-4982-9244-c90a352fef0f", "indicator--9cb2aab6-e614-4b7a-bd8d-2dbc0716395e", "indicator--ca15f936-08ed-4042-85dc-31c6027099b4", "indicator--eea79de1-a916-4e2f-ba57-2ad0e67f0b07", "indicator--35c937cf-3120-429e-9238-9b1d59be9a36", "indicator--55a50086-7f7e-4511-a7ad-2b3147b4d7fd", "indicator--71322c50-437c-415f-8ead-7121034099ee", "indicator--3b04be37-6616-4cc2-a036-a0c1220645dc", "indicator--f953998d-4037-49ef-a5db-a2fe2ef45840", "indicator--b9a2b79e-8be8-4212-b58d-d4798eb2f0bb", "indicator--28530011-4878-404a-9883-20fbf853d86e", "indicator--27f8f444-6315-44ea-9796-f72aa4311dbd", "indicator--a6a15ace-0a1e-42aa-8e49-9194997ed9ea", "indicator--917db6f2-7587-40b1-94bf-cc17dfbb7879", "indicator--37681ad3-b2c8-42f8-9cff-d50172977295", "indicator--31218200-17ec-4dec-aaa8-6a8a5ca301c2", "indicator--b1a3295a-6170-4d41-971e-97489fbb6390", "indicator--4370080f-6ef4-420f-ad8e-3d8484c87b96", "indicator--14e72ebd-2e3b-42ec-b6f2-7ec980dc95a2", "indicator--7d3fdcd5-7ed5-4b73-846a-107d6c19b7b6", "indicator--4b155054-4c8b-4d13-aeb6-0ae3de157dfa", "indicator--2aa974e0-4539-4206-915d-b1c2c5882d88", "indicator--48a281ec-54c7-4aef-890a-7776fb8a293d", "indicator--b248cec5-d624-45a6-89aa-2610f4e242ee", "indicator--236d1810-aff9-4bae-b862-d5ce724d34f3", "indicator--56e2fa01-7c80-4ff1-9aab-77c55c8caafc", "indicator--c84cba95-d27b-437e-b128-68dbf6b05291", "indicator--95f7f48d-93bd-43bc-ac6c-9bfba0050bba", "indicator--ca067eed-77bc-4243-af1c-43ac1b9ca282", "indicator--e0cb6207-9060-4a26-8098-d3921d661a28", "indicator--87a8ff61-26eb-4747-8809-8d57784e773d", "indicator--0f37370a-6caf-4597-a5ef-61fcb3ab8682", "indicator--37e45eac-5bcc-4c19-a656-e7a6e6e8e346", "indicator--a0cb2d30-7883-4090-915a-051db9042018", "indicator--f50896f1-5b42-41dc-865d-1f1382dd34cf", "indicator--33031f4d-e04b-4d01-9744-a3320174a86d", "indicator--690a3ef6-6364-47d9-ac25-72d36cc1645f", "indicator--a6f3b4aa-3bfb-4eeb-9baf-fb60b1ab4d62", "indicator--63609137-0cd4-4361-b3a6-46c1a033658d", "indicator--d55d6c88-e60e-4e1e-a35f-56d1b982e546", "indicator--514cb398-87af-4184-94ce-0090511bd2cb", "indicator--6d81529d-833a-4ecc-b698-c81b9b4d6823", "indicator--47e86290-f061-47bc-bc26-8c8d8e2e4cde", "indicator--a7efcc7c-ef61-4a4a-90c5-87d27509ae5c", "indicator--2d21ac42-a06c-49bc-abea-5f2ad8f3ab2e", "indicator--5d8e5659-a4bb-4002-b373-6ebc2ec9f761", "indicator--79f2766c-41b2-4e7d-8f1f-f65174819c82", "indicator--133f0786-997d-48dd-95e3-f65859d22040", "indicator--bcb94c6b-4e8a-4b05-8a69-8b1a94e608a2", "indicator--737d9344-5569-44ba-b2a9-8fe78df0529b", "indicator--ab46f395-4a11-4d9c-8519-fc6b26c5dcbb", "indicator--a751d77d-9dfb-4f6b-ba57-944c8b5478e4", "indicator--17e13469-0c42-4394-8319-696cc10d4afa", "indicator--5aa4745d-4fe4-4757-8b2d-b29a6f8d112a", "indicator--e68311a0-1148-4f23-9fd4-51b19fbed38d", "indicator--e3fdc94c-1d96-4cb1-9692-9b4055212cc0", "indicator--e1ed0c89-c5de-4380-9621-918b4a034d76", "indicator--daf417f3-6906-4acc-8f45-76a4d580dc33", "indicator--8b3ef0d0-d63b-4105-bf78-96a78ed9f5af", "indicator--669e9b08-a7ec-4a21-a27c-6ead5d2f562d", "indicator--f1f9d689-1d93-422a-84bd-fe1e9a2bb312", "indicator--3c571551-c1e7-4150-8333-ef38ad048f9f", "indicator--640ef0d7-5560-4f0b-9262-656bf37e3e1c", "indicator--1ec0e0ee-3ec9-425f-91eb-090b4b79aadc", "indicator--5ae3f8f0-1592-4378-93f1-8760e9d143c8", "indicator--275d67ad-8cd7-4b3e-a6f3-053e0473bf20", "indicator--722f2940-21e6-4db7-b68a-7f597ffc90f0", "indicator--f5f9128f-4fac-4d89-b13f-897bee990cad", "indicator--76985ca8-6993-49fe-931e-90680cdfe1d7", "indicator--2c277dad-0744-4058-9c67-b3b309dfcbf5", "indicator--77893b9f-18ee-44ee-97ea-1cf629c90a35", "indicator--a201fde9-75f7-4355-85a4-b8f2e920bae4", "indicator--c21ab2a5-0580-4bf2-a914-d27901a5c81b", "indicator--54920611-99a2-4d38-a1c8-108b401f7812", "relationship--d50074b0-8016-4fcb-a584-e72b520ae6e5", "relationship--189d2ef2-ee5b-4783-9693-2b2b3bb5a14d", "indicator--6da7b7c6-cbec-444e-aeac-1196771fa6b6", "indicator--79606229-82e9-437a-bb61-87985a2c0e0c", "indicator--9a8ba71f-63c1-406f-8ea6-363168ae0f7d", "indicator--dc86888d-3701-40ab-b706-1c80998e9d50", "indicator--6ae09423-7b04-4016-9845-db5e2e401114", "indicator--9270ac86-7139-4e74-a20d-dd1a0b39ae38", "indicator--a5d5f5c2-8ca1-4fe3-8a9f-c15974f1f750", "relationship--1d4ab304-1498-4e37-afe7-07f28337352b", "relationship--24d63fc1-2e30-4bf6-b549-cecf8bff4db0", "relationship--b350c9fb-6f4e-4567-91f4-0cd8a3bb664b", "indicator--cfb749af-9169-4717-b73d-851a31b1542e", "indicator--067f4fdc-18ea-4014-8909-5cfddabb0b7a", "indicator--6b53cea0-8d17-4f91-aa2f-8cd4837d7274", "indicator--a132513c-8f29-496f-8d2b-ce337aa1762c", "relationship--55c15905-f1b4-4824-bf59-0556fa9c0323", "relationship--7a84c6d6-c248-499a-844c-589ebbf5fcf1", "indicator--8626aafb-21a0-483f-a627-30c262a7adfa", "relationship--945de56c-093c-4a49-8375-d08a4e955d48", "relationship--c55b27b6-91c2-412a-bd7d-ed8d1bf73c2b", "relationship--ae7e88f3-9bad-4e21-8c34-55a71a425c54", "indicator--4f577858-af3c-42c3-a574-bfe8d03fa5c8", "indicator--c6328c1e-7fd8-434e-98e9-03d4b1117ddf", "indicator--08ef5f04-a416-44c6-9ece-43cd350b8290", "indicator--d886b4dd-f066-43af-bbff-9615a4893829", "indicator--fbdfd4b9-ca06-4c92-8574-a487d847dca7", "indicator--cd314075-b975-44ab-b8aa-25880b45fe52", "indicator--95b2e6d9-e172-4cb0-a545-654cf5b9b7f2", "indicator--f51a41d5-40c9-4ff7-8e2a-3c08165ec917", "indicator--6ed1ebd0-50d2-4308-9203-febf0466f868", "indicator--f0c302a3-7362-4bb5-8d43-855d8dc92c16", "indicator--45fdae37-0f7d-40e6-acaa-a88a8dc49174", "indicator--0341895b-9ffc-4894-b92e-ce17c8ac30d1", "indicator--57568164-d930-4c35-84d8-6ae1404f9fbf", "indicator--27ad2392-2b33-4126-a529-8b772694e4fb", "indicator--2cb146f3-1584-477d-9932-b16d76fa8a53", "indicator--0541c04c-8ed6-4171-81df-0117b593f728", "indicator--266fb56e-7df6-4c60-8348-b397d43ffc87", "indicator--a44fa219-f1b4-4fbf-8990-5683933cffae", "indicator--31f4d846-fcf8-4c44-b60d-244d5c523cd2", "indicator--042b2f03-12db-4187-bcbe-ab4864c6eda3", "indicator--002b9082-56ea-42a7-9c0f-bdaf55157463", "indicator--0b3a1fbd-48db-4f81-a963-97ee605e88ec", "indicator--70d54ea5-29ba-4ad7-b9dd-4bf4ea70f68c", "indicator--8db753ae-63cb-4a4d-b171-18322b315d44", "indicator--0eebb53e-6dee-4608-877a-49616b2a9206", "indicator--252ccfc3-aa55-46c4-bb73-7ba2fc1d054e", "indicator--7156c2be-4da6-47ca-8fef-2f8c65e498a6", "indicator--97873e9b-7862-424d-ae3d-8769901778c9", "indicator--81039d3a-0c1f-46b9-9dd6-b6f24fc5a310", "indicator--8b5f3204-ac8d-4e4f-a4e1-8a709609c214", "indicator--7b956ac5-8a31-41d0-8d0a-0dbacef6b6c1", "indicator--c584b4cc-dbed-48c8-ad53-eabae2fbb3c1", "indicator--3fe49d19-0a7f-45bc-9474-c3ad2d698b3a", "indicator--36f0f619-4635-470e-b607-b50b0c99399f", "indicator--3e9c5915-a008-4617-8ea2-1f3628523684", "indicator--d8f3dfd7-ac6d-4143-9d5a-a88ce41146f9", "indicator--f06d3086-8c5d-43e6-83fd-980511017f65", "indicator--bf1028a7-e9f3-4d94-abf3-d75b2e56336f", "indicator--25dca53d-3f64-42fb-964c-a93b95430034", "indicator--b3005bd6-05e3-4f22-b8d6-4b715dd74803", "indicator--48a42d0d-359e-42c8-8088-c02c5d40ae2f", "indicator--62301df2-896d-44d4-8df7-81f6279b2f44", "indicator--298d9329-f335-4cd3-a27b-f6a87f7e102a", "indicator--84e721db-6674-4dbe-a925-eac8dd498758", "indicator--7f5c2c4e-36ac-46c8-b5fd-308be74ed348", "indicator--3f7ca3f6-b081-414a-a9e6-955919c2ea64", "indicator--f7bb023e-b929-47f9-bf0d-c6ce6f945320", "indicator--eaa10b93-2df3-4811-a548-22915e0ad350", "indicator--848abc1c-9a12-496c-b23a-1ea6ac677bfc", "indicator--b2e1a0f6-8077-4c1a-833b-c96700e979eb", "indicator--06e042b6-9537-4a2f-bb01-e4754be4c15a", "indicator--ef3ecf3f-e88e-437c-b290-f768b90c2811", "indicator--737098ab-c0f8-4017-8d4b-f0ac486c2454", "indicator--4d49f35e-d109-454d-b067-aed7acc8f083", "indicator--040689d8-7161-4108-ba4e-b9c77255e7f4", "indicator--3d9ff791-02e3-4e6a-9528-976ba6090775", "indicator--f0151dfd-22d8-4a58-9058-b568992b30a7", "indicator--8b86f239-2057-43c7-9c36-358b1c306e4e", "indicator--7c14f678-3ab3-402b-940d-4356caba3608", "indicator--bd336f74-a5a7-4722-9c50-13a229011958", "indicator--a38d8bb8-7529-47ff-a8cf-1c6fa74d98d8", "relationship--aa6064c0-8e15-4f53-a312-392b2e70092a", "relationship--35f4f850-f662-4062-97d8-09af50f9d8e8", "relationship--a53b66e5-40f7-405c-8c3a-95f17b73e137", "relationship--5c92ab13-3622-474c-a960-d1b08bdcbe8d", "relationship--192af310-8165-4298-85be-8b99849b8990", "indicator--fc6e4893-e162-4472-a812-798af1167ecf", "indicator--9774cb38-65a4-465e-bd95-22f68cc8c75e", "relationship--a694b2ea-af86-42cf-8854-b42025d01c3c", "relationship--e1714aea-1cab-4f6f-853e-c026d5573ebc", "relationship--298b4f65-4aae-41b2-af8e-96ddad80cb66", "relationship--055c50ed-5289-437e-b0c6-fa7d9b4f9c53", "relationship--bd26e9d0-b856-4a6b-9782-820697cc5410", "indicator--c9d701e3-1ff2-451d-8356-29779b57f2ac", "indicator--90c4ab79-bf2b-462c-abf7-073358089362", "indicator--2363fac1-38d9-4cde-87e7-06f339f72162", "indicator--2b885d9e-d111-40f2-bef3-053bccaf73aa", "indicator--5d2dfd9b-a701-46ba-9fa8-f64dbebb3e49", "indicator--629f4e66-791a-41c5-b012-af89628d47d1", "indicator--451d82eb-7504-44d8-9904-6a379bec7f8f", "indicator--004bb35c-7187-479c-95dd-6d95179fa88f", "indicator--d093e952-31ad-4166-8312-987f9980d204", "indicator--9a4b26e8-0498-4379-beca-8f71b1904291", "indicator--fa9e219c-91f1-4ecb-8783-b1e47ac78db0", "indicator--6098a23d-11ec-4c57-9980-8788f2916c57", "indicator--13ce7d1b-b5f6-4f67-8590-c0ce65fa9719", "indicator--b5187dd2-aaa6-4c76-9a80-33a8cc27361a", "indicator--5cd5a3a5-12d5-4328-8cc3-6d11fc1f70d8", "indicator--1a76fa53-5b7c-443a-968d-54e20466c25d", "indicator--1383927f-63b6-4ea1-9058-0451bf6f0bdd", "indicator--4c941e1b-1b59-4923-bfaf-6be6298c1635", "indicator--817d3a55-2253-41c2-9a4a-7e8e945a0b43", "indicator--73de9e7d-eae5-46f5-9f26-6deb91e13b3c", "indicator--5390da00-feee-4a42-8ec4-0c36eb0554f4", "indicator--341c66c1-b4dc-4cc2-b379-22906befd00d", "indicator--3ea921c2-8d73-4126-9b28-db7e5d996988", "indicator--a99b9010-396a-45d7-bc9b-aba0afbdd6f1", "indicator--7151f304-e5bd-4efb-9c03-b4d551ee5746", "indicator--696ede57-cf91-4800-bfa8-ed9e816bb110", "indicator--69374934-404b-4a6b-b31c-b5c1d80a9ea0", "indicator--d8b01c10-79df-4bb8-9537-073d2f55940e", "indicator--86c7cec6-3213-4559-8343-8fa50edca54c", "indicator--2f3d5dd0-de7e-4601-a10a-9b307623c304", "indicator--6f6063cd-7861-4f22-9e87-f4a950d55a34", "indicator--01b604fd-2a26-444e-8121-0391576d822c", "indicator--443732ef-fa6d-4e08-9ce8-5a21a94829ce", "indicator--776371af-4451-4bc6-9bf6-20b0d2c83a17", "indicator--b55d4017-bf2a-476b-8182-c20a632b6295", "indicator--5a6674c3-489c-49dc-9069-656ce46efb1c", "indicator--76f254f4-e6a3-4197-b9a6-9c693b329372", "indicator--30631815-b3c7-48e0-8431-92c783b5d68f", "indicator--371d459a-3241-4d53-bf06-778e5eff043e", "indicator--6ac9a356-11fe-4d3b-aae0-307e5389b059", "indicator--aa7636e0-9f1a-4be9-970d-02ca0f2f1f0b", "indicator--f681c5c2-0b99-439e-8f7e-505c41a02c33", "indicator--e52f60f1-16c7-43ad-a575-763d861025a4", "indicator--7b3dd300-9bae-4b2c-b92e-112fd18ad6c8", "indicator--ce4660b9-5065-4c4a-9ec0-49a8a83b5cde", "indicator--a5d16656-285e-4e2f-b6c8-4d85603494fd", "indicator--8a8023dc-0d33-4975-aa2c-910652793ae1", "indicator--53b07310-7186-4f41-8f4a-7aeb7852b44a", "indicator--c4ad2477-5643-4112-beb9-d49b17eaf332", "indicator--73a99f06-6566-41eb-9872-8eb1c054cb99", "indicator--f0637a3e-519c-407c-9e3a-d2b9fb10a273", "indicator--7d1cf65e-c7af-4799-9cd7-bb536a2384ba", "indicator--7633080b-de13-46d0-9782-9bc06ac509f9", "indicator--1cf2c2d6-8f13-4a9f-8804-43c66cfdc393", "indicator--315059c5-d8be-4721-aca1-0afdae3008b7", "indicator--c125c929-83dd-4e9d-9380-099ef7b2bfb3", "indicator--b73954ca-72e3-412b-86a7-84b0e23d9c63", "indicator--ad5a4e0b-40c9-4706-9da3-d5b020eb8bf6", "indicator--bcfeee35-cdce-4b24-8be7-8bad97db4aab", "indicator--b8677d34-a2db-43c6-b90e-c0cc31e535da", "indicator--d8e1a9a0-b19d-4863-9fb8-89ac2669d6b0", "indicator--10acf6c0-f83f-4d2b-9568-ea683cd4dc9e", "indicator--f04b6d8c-92e5-4fa8-bada-79d869dd532c", "indicator--5c96a6b9-732a-4f91-a8b4-ab9f95dae21c", "indicator--ffb54b12-2910-4678-9e94-e7ebba2e198d", "indicator--252cc3eb-3a40-4b26-8bf9-4bb33d093995", "indicator--bc973496-bed5-4930-b3de-a81d7ce9b4bb", "indicator--5eacff47-236b-4580-a374-e58e337cf108", "indicator--c4141428-7280-4ded-a94e-f52e52ef2fc9", "indicator--513ab47b-8be6-431a-b53d-65d1334806d1", "indicator--5acfc6ef-73d6-4ec3-8717-f3e325f487aa", "indicator--bbf39466-1b1e-4dbd-8362-c58d5242a53f", "indicator--82f54565-ab72-4795-9c68-2f44f5343832", "indicator--c510812e-1633-4f55-a4de-3613daf0e781", "indicator--aa34af50-75a7-40d1-93c8-ee4eee713774", "indicator--e9cfb976-a26b-4488-b67f-1a56a8c012bc", "indicator--f2ece4a0-592f-407d-814f-92c1e54c1481", "indicator--54e1cd3c-785a-4f79-92bd-5fb14b6d3d5a", "indicator--278a3f7f-0b5c-4283-8137-db049b38d26b", "indicator--3d1777de-73a8-47c0-8918-466d78e27bd9", "indicator--0ff02e1b-858c-4f89-acec-c8d4c28820e4", "indicator--39d6cd70-6cd3-484a-8592-cbc1df16a8c1", "indicator--0761ab1f-804e-4737-bea0-c02706925a0e", "indicator--ed753517-65fb-4382-9750-6115aa24a12f", "indicator--b0fdfdae-b5d6-4548-9fec-d92fec311f07", "indicator--d27f2325-a7a1-4ca7-b92e-ed4c0962c35d", "indicator--fc47b3a1-912b-4936-ae7d-6003694b7bff", "indicator--adf3671f-db70-4698-8f57-b8fb06eacbe1", "indicator--a498593b-7b97-4d12-88aa-499f9a122ca4", "indicator--3a68ead8-54eb-490e-a95d-91542cd0a304", "indicator--0f272ba4-3075-4ca2-b72c-9473953bab3b", "indicator--51bc64bd-b0f3-4466-bd21-b43e8a022c72", "indicator--2b645bc7-0674-4432-88b4-3ac2c121c465", "indicator--6e25f00a-e626-489d-ba78-26e53af752b9", "indicator--2b1402e7-3977-4db2-a599-a62d15b22668", "indicator--f7cd2500-91cc-4d7f-899a-5b4bc7ee5350", "indicator--5f8bdaca-34e9-4331-b098-42a1f1c6ec91", "indicator--f680e1d1-1088-4bb8-8210-dbb3795971cd", "indicator--427885bb-7741-43da-ad12-3f3a6bbc05a4", "indicator--1b383604-0733-4c74-86c3-9b07ff3053a0", "indicator--8764d6bf-06d7-4a85-bdf2-bee533187c12", "indicator--091772d1-e3aa-44b8-9f06-52673ccbf0e7", "indicator--a793d0be-e49c-44cb-b037-b467f2063dce", "indicator--32268e56-fd7f-4a0f-b48a-a8193d6d0dad", "indicator--59c36667-e898-4527-a230-52f034d00853", "indicator--ab9c022a-ec70-4ed7-9f8d-90c54747a8a1", "indicator--bc865eb8-d46b-46b6-b590-111788955c4a", "indicator--2520fb85-4efc-4384-a0f4-90d9e64af0bb", "indicator--87bcbd7e-0f60-446d-ae8d-a1598973b122", "indicator--a2f61f5d-270c-4bde-b17a-a045845a6428", "indicator--08bf1466-8e62-400d-b62f-3aac88277aa0", "indicator--08859bce-b286-44a4-a4ff-bdf611b57f70", "indicator--8a41a1d3-5e2c-4a5d-8c5c-c4cfb871ecfa", "indicator--08a069f3-a80e-49ac-87d5-6387557d5f58", "indicator--582c97a9-473d-427f-8298-d4f6bf4564c6", "indicator--8be2b5c1-ca55-4fb1-b936-d1832a0eebfb", "indicator--4b46a09d-6d1b-4241-bd8b-006b7880bb88", "indicator--66b9e881-cf8e-4b81-b991-ef99660678f0", "indicator--4db82d05-224a-4d02-9f14-a1d25442f861", "indicator--1cf9bedb-687c-4406-a29c-fbead3f5d8bc", "indicator--cfc63dff-f330-4a3e-b5dc-ea160438471f", "indicator--e4d2a04f-d717-4655-ab1e-a3bc1d01c16c", "indicator--2caf6bc1-ed3f-4503-863f-9acf0f13c60e", "indicator--3ceef5af-a8e9-4461-a0f8-2a1b78378604", "indicator--93968509-3197-441b-87c2-30f7d74059ee", "indicator--cee9c4fb-7279-47da-8617-0e82ee1d799c", "indicator--69c2050b-f7d0-4b7e-bc6c-7d7907d845a5", "indicator--1f4d69e6-0b87-47ce-affd-bee5e91bd913", "indicator--76c107d7-2c9e-4dc9-a6ea-504b68d05dfe", "indicator--f1c8f4db-0a9e-4119-9002-c13d4c2d166a", "indicator--25fcd1c1-464d-466b-9482-4f4f94e0b87c", "indicator--613ade95-2628-49f7-921e-75444ba35d60", "indicator--ef50475b-ca11-466b-8d64-ad238d27f630", "indicator--92d04a09-159a-490c-a93b-79697f8ea5de", "indicator--4415b5d5-cc02-4685-a7db-f82e849f0512", "indicator--4448ab55-c118-4f3c-9457-2c00ff076141", "indicator--09acaca4-52e4-4f70-88eb-eed38043d921", "indicator--26fa9b4c-6bb0-4b65-b36b-8865c4ebf1a9", "indicator--4ac3eae2-aa5f-4d70-8ca5-874bc9d0a799", "indicator--66800a86-a653-47ed-8aba-89e05db8bc1a", "indicator--418e5d5d-b0ff-467d-a11b-dcf5fa68921b", "indicator--6352ebad-106d-4ef8-a23b-333f6791021e", "indicator--434b2e48-cd1d-46dd-ad74-4a7a8230b012", "indicator--9d4482b9-5571-4da1-b5c6-7a9878d57eec", "indicator--7bcccd12-79b4-4d13-901e-b8a90761f74f", "indicator--d3a1624d-d0ae-46ed-b606-2786d204b227", "indicator--ff767d4e-44c9-44dc-9599-6633e80b7781", "indicator--b11e9da6-a4a0-416a-b74e-28f2877fb3d0", "indicator--4579844d-e506-4acf-a054-2bc0308aa7b3", "indicator--d212f8de-5f6f-4449-b526-2751e2f5f95e", "indicator--4980d57c-1dda-4c7e-9a87-2ba7af0f9134", "indicator--f32c9623-774d-4832-97f5-27c8cef1b46c", "indicator--fc81293f-50aa-47e3-9b9c-20fe5a7b2316", "indicator--c7438b7e-1c91-4000-b12d-125608e7f2a8", "indicator--47410eb8-b48b-496d-98e7-f58a57668ba6", "indicator--f3d22c87-e50b-487e-ad79-610349d2b61f", "indicator--6aff369c-c62c-4c32-b70d-8ac108959d8d", "indicator--9254e366-6f8f-45ac-ab64-a446222f658e", "indicator--3da2dd63-dddc-4af5-8e8e-72435d861a28", "indicator--3f70a762-9201-4151-b68d-0602104a6d98", "indicator--e0938750-11bf-4320-ab05-83ae66b1d5c3", "indicator--2aef8992-e6ec-45b0-8242-18f528397d29", "indicator--7592288d-6836-4949-a008-fbbfe2ff4f28", "indicator--a97bfdc5-a2d3-46cb-bb49-3206ac6e68df", "indicator--1e67fb28-9557-44d4-8fb0-358ac86ff9f5", "indicator--c9145af1-51b9-44b0-b6b4-10b30056705e", "indicator--c71305e1-422f-4e4d-8c69-cb0e8c876eb4", "indicator--09f3d16a-fd18-41dc-9a3e-cda4b3bd64b6", "indicator--a95ba8e6-f56d-441c-bb9d-ae610dc232ce", "indicator--3590e111-eb5f-4433-833f-20cfb87a1d75", "indicator--c396f5a1-aaf7-4bff-a735-cad33d86053f", "indicator--259a82a3-c9b1-48e7-97ad-b08fe60ed44f", "indicator--bef2ce4c-5b2e-4043-b856-5b84f748c634", "indicator--a20168f4-bb88-419b-912b-d6468fdfce77", "indicator--6767cb93-7406-496b-b14c-8256fb82a2e6", "indicator--d8e5c977-1282-4997-a870-08146ca8bb82", "indicator--2d2a53f4-3f8d-43bd-8f72-cd7c83bc9a8c", "indicator--47fc17a7-64f6-4705-b8c5-b49d05674a20", "indicator--57c5197d-a845-45f1-a72f-508eb48c28ec", "indicator--6d2b2fb6-7b05-4c84-bc70-e2ae22be7038", "indicator--0712cfb8-f531-45cd-abce-3276c0eecab3", "indicator--959e3cef-5028-4a9e-bf23-35e158791254", "indicator--53bbec3b-d29a-4935-8f91-c5c3d7c544f3", "indicator--1bf79228-5ec0-4791-8cad-0d160fc24c81", "indicator--9b3f7a11-9a43-4456-a751-44410d3f7f59", "indicator--bb299ede-0eae-41b1-b4ec-4f86c410e679", "indicator--fc94762a-c571-4dbe-804d-97c4568f80a2", "indicator--ced784d9-b365-4d19-889a-568a6a15a805", "indicator--1094a5f3-4098-4574-8a6e-a74ed25fdb75", "indicator--2cea6050-5142-46dd-8f46-4336766b84d5", "indicator--a72b462f-8102-4693-ba04-be6a528434fa", "indicator--43f31c52-fa04-4f5b-b9e8-d4bc639dc9e6", "indicator--c6c5d19a-29b7-4ae2-ad39-96a6af07f4e7", "indicator--4c7efbb0-c1e1-487b-9cf2-439854eec101", "indicator--6364152d-67ab-4417-91e4-18c6a1d352b2", "indicator--e715018b-5b74-4706-9807-57db5cdf8aa8", "indicator--c2a47e88-fcf1-489a-9580-f8c176bb7624", "indicator--86876d9b-943e-47d4-b44b-964c7397697c", "indicator--4557c98f-5ae8-4e9a-88d9-54ba2008871e", "indicator--2a786202-eaa7-4a89-93a7-f65d3e648f82", "indicator--92533aa0-8583-4eee-8a9d-a1daadbea244", "indicator--12db2075-553e-49b7-9bf9-0ad92fad10b5", "indicator--a71bcc3f-c4db-476d-a8d4-ce1da30432c3", "indicator--41490e57-8583-42eb-afe8-6f81ca81e58b", "indicator--3f9153de-5ac3-4db5-83f8-cbfe441cf9d3", "indicator--272cc8f2-46a4-4869-8e52-4e8b0a89b03f", "indicator--598f0b1c-2b98-414b-af30-2a3273b8a6e0", "indicator--de28e932-ea85-4400-ac6c-06bfb2eb4b98", "indicator--03f475e8-7aee-4395-9d5d-f82164377529", "indicator--bb84cc76-a099-4c33-aa42-08e53a091b0b", "indicator--6b78b958-130b-444a-ae53-82746b7e96eb", "indicator--9c77f47e-42b0-45db-8cd0-e220faef59ab", "indicator--54d9ae90-39d7-45e3-b93f-11ffcd2d04e7", "indicator--715a8c03-4cf7-4f26-91b5-95e21cd6b353", "indicator--2c5362e5-0a61-46ab-a211-fd7108c4796b", "indicator--9eb9831c-3c90-433b-b62c-baa9c15c7de4", "indicator--9ca3c064-d230-479d-ba81-d4cfdb0b714e", "indicator--90e528e8-e45b-4bf4-a788-30b7f7a77ccd", "indicator--e9433ac8-0d56-414e-a0c2-317645a81772", "indicator--f463f251-1b54-4583-9dd8-16dcebc19103", "indicator--d75d9996-8eab-4cd4-8c54-8ae1490ea74e", "indicator--e41384f5-0e2a-4361-8d4b-0d3b17e12a38", "indicator--4a02489c-a84c-4924-aefb-9d3b4228fc6d", "indicator--9d279c7f-2140-45cd-bda7-3a731d8fae5e", "indicator--35359ade-b4f3-4007-b080-200bd700aa66", "indicator--c6d43141-3d96-409d-beae-82caa10e8fc6", "indicator--69542644-3b8f-4690-b3a1-09417abcf729", "indicator--2d83a0aa-6f35-4383-91a3-0dc97009f194", "indicator--787bd02e-4480-4482-882a-d166bb34249f", "indicator--7adf7c11-1bf3-4ba7-891c-4c3b8392cfd3", "indicator--d5aa6938-8c38-4cfd-b135-5ffa89134443", "indicator--cd1f18b9-af6a-454e-94e6-7e60f6c1d1ea", "indicator--16f96bf7-664f-4e01-8998-97ba5906c7a6", "indicator--57e89767-d074-471f-b10c-964117ac402e", "indicator--46150145-090d-40fa-b3fa-f240e0518c89", "indicator--8f0e41f3-8af5-4038-852b-65c39022e1d8", "indicator--2a0ce547-3636-45d8-99e0-6ea7740ff7ca", "indicator--2cbc4686-caef-4594-8513-383c10802681", "indicator--e3b3d062-2def-4cfe-b1ca-bdd202e36bcb", "indicator--c6c5e6c8-5a30-4024-93a1-41b129672a0e", "indicator--9650b84e-3743-4b73-99c0-041499840fbb", "indicator--6762beab-3541-4a5c-903a-8351e8798146", "indicator--5a81c6f3-d356-4fd1-86c1-c209e90f85ab", "indicator--fae0c2c7-4c1c-4674-8d02-672d120439ea", "indicator--9964cd9d-bfc4-4dfc-8047-6a996eb7f722", "indicator--96c02ba4-42b2-4201-b543-a58a5bcf6c77", "indicator--fa755bdf-af7a-4945-b9b9-4f350533e564", "indicator--1001b5fd-e39d-4280-ae47-36e690072719", "indicator--26c16f04-2732-4072-857b-53afcb95f3db", "indicator--15cfbb27-923a-4a84-9139-63841858ef07", "indicator--2d762301-2534-46f2-952a-babf91349b34", "indicator--596dcd09-55cc-476b-a743-16ab4d7c34c0", "indicator--96773662-3a3f-47b5-a0b3-a07e25c6e290", "indicator--4352527a-4868-41fb-b315-08aab1b4eba1", "indicator--73a068c0-7d91-4117-bf9f-e9df9ad81da4", "indicator--97d0224e-0901-4fa0-bd11-09cd032fd510", "indicator--bd3ca081-87e2-41b4-b6b2-c8aec93ba5f9", "indicator--fa8b2d5f-9088-4a5b-b34c-d0ad51ce2d6b", "indicator--afc533d0-693b-4200-bc5a-cf4dae3fc124", "indicator--d40c60ae-821c-45e0-a96a-c63ec654268b", "indicator--63f874d4-cdbb-4cbb-a2fa-b132b10c8776", "indicator--f8aae3e0-663a-4820-b458-7b03dc1fef41", "indicator--d94b997e-989a-4c36-8cda-8d8451df7873", "indicator--afefc47f-32f7-4607-aaa4-f6b3d368893e", "indicator--8f215dc2-934d-4f2a-84f4-4b691a52e92f", "indicator--f396240c-aced-4f71-9e45-087c2bd7b6d6", "indicator--0c53fb79-60a8-475f-972f-07b665e3ca07", "indicator--daf8e753-605c-427b-9972-1512dd47d3c9", "indicator--841be80f-9ab1-4d64-ab95-83cbe3620bea", "indicator--0bf032ce-c336-4540-81c7-e9492bdf1649", "indicator--45ae2426-2b2e-4cb8-94dc-6e1495de3898", "indicator--943af044-1bf4-4d95-bda8-7cb8dfc7948e", "indicator--40dfb008-c531-4ca5-bb0b-8e10be5f1f61", "indicator--f2b28349-29c1-43a7-8804-3d13e8412776", "indicator--e845621c-e5c3-4e33-a53f-bafaff488717", "indicator--72e00293-e7c6-47e5-8485-f70659e27e4f", "indicator--7eddc338-0a08-4880-8e05-d0ad95b458d9", "indicator--f2636d16-c0b6-4c77-a226-cc35a5846a3e", "indicator--92003f45-42dc-4e13-9b7a-eee641e4d1e0", "indicator--908df4f1-e5d9-4a18-b2c2-45a77b2711ff", "indicator--861168dd-2638-42bf-8a27-da2e745ffcfb", "indicator--e875422f-5ff7-47ce-a4fd-1d7cf5a18567", "indicator--415f4d8e-5320-40e6-a8db-022755d6a9bf", "indicator--68fa6eaf-9fa0-4b59-a145-5efcea1b1a6f", "indicator--e34cb19a-d54b-49d7-ba02-8d6a751e9b87", "indicator--8a13d9ed-c439-4f85-bf8f-70b119288ac7", "indicator--44879a2f-1c65-4fc7-9095-364021f16fa9", "indicator--9fcb48ad-366d-40cf-9b06-1859c819bd7c", "indicator--8ed64fdf-e1f6-4138-8941-f8bd4b9c7502", "indicator--45eeda4f-fe28-4894-b475-67c04316615f", "indicator--f9b58a75-84b9-4524-8df5-64e56471d448", "indicator--4a1f22fc-9c0d-4461-8c8d-48923f72bb86", "indicator--827201e6-0462-40a0-9115-ffcd3a38a7d5", "indicator--0b12bf0a-263f-4f87-8d06-05a51faacd1d", "indicator--eca142ea-d528-426c-b812-ac267826be37", "indicator--892912a8-a27e-437f-8fc1-961eb824fc7d", "indicator--acac1119-87c0-404a-81a8-441ba6088d7e", "indicator--53c3e7ee-d944-4fc3-bae8-f14eecd27b06", "indicator--2bbad52f-845f-435b-af3f-ec2bd4bf2ba7", "indicator--1e396a63-4127-4f4e-9f86-3b9d499d51c4", "indicator--0679c46a-7f18-460d-961b-b7126ac3038f", "indicator--ba1e5d43-4a43-449e-a1b5-6d2b20f1c17e", "indicator--9cedd06a-f867-4b31-92cc-045396e59554", "indicator--d4f003e9-cc15-4509-a38f-90dee9440454", "indicator--9094978e-cd68-4e08-8cee-76951e98bc22", "indicator--ed4a1c0b-3874-420a-9e2e-4c90d2dd9c41", "indicator--74cde68b-c9e0-413d-985b-76feb4a127c5", "indicator--2b5fccc4-0d79-4ba9-80e6-923de27eb01d", "indicator--f935ed6e-622b-4274-9d5d-5a69bb498107", "indicator--cc958b15-b12a-4e9c-9c54-f6e5293a920b", "indicator--2e2d063a-9c9b-481b-8139-67e45524fe35", "indicator--378cf488-555f-49af-b6f4-b5823237990b", "indicator--86263375-e5fa-4701-9374-5047c8c41dfc", "indicator--cf371fb9-8e82-4b93-b560-e74f9ef25ae6", "indicator--49399c22-ce12-4e33-af05-0804be45b4ae", "indicator--b18af023-b8bc-4c1e-ae35-702017723471", "indicator--7830df2a-654f-4131-85cb-e43070bec37a", "indicator--5ec16020-df4c-4128-a6b8-6fd6bfd781a2", "indicator--67ef490c-9fb3-4b37-9184-a31d774a3ea1", "indicator--246ba778-edde-4245-91d0-83f4bdbebe28", "indicator--18d6d57f-4ff9-4732-a4ba-10a8fedee453", "indicator--e32995d7-3265-42f7-b0f8-225876868377", "indicator--a9c203b4-070a-4ffd-bcef-880d3ecc1af6", "indicator--60715f12-00db-44b8-8b82-c78248397a23", "indicator--baf49183-315a-433f-9680-84247a4f9ebe", "indicator--46990ff8-d9aa-46ce-becf-6355f0353a1e", "indicator--d2133bb3-ef02-499b-98b4-05d5f38d57e9", "indicator--d218d0df-1dfe-406c-8d28-fc5bad7a4d2d", "indicator--7a37b5ac-4116-4b1c-9454-6676b478e98e", "indicator--62b60522-8d19-4643-8b10-2ebf05408d70", "indicator--17001d36-3340-41ec-b79b-06cb66d57b44", "indicator--9d1aeea6-e045-4440-84e8-9037ace4c75d", "indicator--47ce58c5-04f3-4c82-bac4-efe9b825fda2", "indicator--422c935f-d326-42cb-b318-8838d7ad5d72", "indicator--6c5e9057-3839-405a-b932-d9e69f6ae89f", "indicator--74cdfc81-5fc0-4607-ab37-d605c8bc2cbb", "indicator--9150d2c0-a179-4fa8-8095-a00158dc8e11", "indicator--bce88072-0210-4553-a772-f6e6bd3f1800", "indicator--5eee6e51-cae4-48ab-abe1-bf0a9db355b8", "indicator--032804aa-7546-488c-8018-9d01c977b002", "indicator--2c5178cc-d0d1-40d5-9b78-d469e1f5bf70", "indicator--bc6f3764-47ab-4e2a-bb21-49d2bc5815e1", "indicator--eb1ad34e-6b16-4f9a-a7f8-e115d18f7a42", "indicator--ab9ea132-3577-4085-9047-3cce0b782ead", "indicator--b429589e-9aa7-42d5-805d-409d9a8036e7", "indicator--6dd84eaf-3d92-4f5d-90d2-ceb3f9beff04", "indicator--b0ce686b-9aba-4860-82e4-c3a5d620eede", "indicator--2da7d94f-01bb-4dd0-8d39-70a82bdc6e88", "indicator--c6128af3-0c92-4fb8-9415-5999821854e8", "indicator--dab1672e-a8f8-4f57-a1a5-8f011b1c8e22", "indicator--6a000233-1b7b-4c5b-a80a-c1e09ca7f4e9", "indicator--317d656f-e428-46d0-8ca4-dfc2d345989b", "indicator--81f0d181-356f-4a66-a833-32c6868f9e3f", "indicator--02bb0d42-6008-4cb5-adcf-f8f58414efb1", "indicator--0330eaf0-4a8f-4a84-93eb-3936ab7a130a", "indicator--1a46fe13-d32d-41f6-88c7-784ca0778f03", "indicator--f3e4d1fc-da0d-418c-b6ab-2d3243493695", "indicator--85850378-99bd-46d0-a5f0-de24586981e6", "indicator--d378cfb4-9a4f-4fe5-a102-d3407a77b7ac", "indicator--de391b73-5a08-4e3d-95ad-4a4a0c9b5f40", "indicator--73486344-304f-4b2f-b9a5-f632658669eb", "indicator--a3444681-8f3f-4377-bca6-829d04faa0f9", "indicator--762d34cb-db7f-49a9-be7b-1e999c8a5100", "indicator--f2766f83-ede4-4cb1-8b20-0d09acedf752", "indicator--19a1614a-b425-4523-8277-eb184c39ade5", "indicator--4d8c10c4-7f25-408a-8851-438b76df703d", "indicator--130ee2ba-dd04-4072-b5b9-aef61ad8b4ab", "indicator--c214e169-d34a-489c-bdd1-e134233e99a1", "indicator--42f1d1cc-8172-4b99-8563-bb12aa782f70", "indicator--c74714e1-9ed6-40d5-87f4-a2ef81a237b9", "indicator--9eb00e87-050a-4bc8-8fb1-456ff778bcce", "indicator--a63bad11-2b21-4478-a6fc-09b56417a263", "indicator--cc06dfe5-baf4-414a-9bcf-702e1475916e", "indicator--9af34cfb-5219-4f5c-81b3-8ceb3e324d69", "indicator--199dbcf3-abeb-43d5-8371-edf4ac46aeef", "indicator--660f2c58-a024-4540-8808-1a35e8638186", "indicator--8d0672d6-6b02-4224-99ba-6355af0786f7", "indicator--060b7aa9-4916-4624-9b2b-16557af2e15c", "indicator--656e54c4-d5e2-4647-b827-1949e6a2e9dc", "indicator--eed4187e-c914-4c66-9180-139b6260c95b", "indicator--26e604b3-a212-4b09-9978-14e9106ce5d2", "indicator--cd65b0c9-3ffa-46a0-8b4b-773ca62c1b41", "indicator--5cf5c0ed-7ffe-4d46-8308-0e8dd3a74286", "indicator--35d5d414-34e6-4770-a852-7ed93ee085df", "indicator--cf722387-a6d1-4b7b-bf96-79a6eab7393e", "indicator--48602fc0-f865-4449-ba63-8193352714c4", "indicator--c2f9aabf-92fd-4467-96d8-99af88b16d80", "indicator--bdc82a00-8118-41fb-beb2-dafa99e5fe24", "indicator--42f5eb2a-96a5-49d4-a7ca-4e8a6f5c37a0", "indicator--19fa3f03-4936-425a-860a-88d8d3792b95", "indicator--9e16596a-bfc7-4187-ad33-c51a6529fb01", "indicator--d2662767-816a-4219-87d8-0d2e80e8bf61", "indicator--2137f7f8-5f58-495e-b5dc-543702f26e9b", "indicator--4fb2e944-168f-4838-9d50-286c326c948e", "indicator--11e33d1d-e903-4c76-a95e-3dabe31179a1", "indicator--bcd87c2d-7995-46ca-8190-072576165418", "indicator--28d186d0-72b8-47e4-8409-f263f5705f15", "indicator--be07d3c3-681e-4d56-ae70-6f50b05f3e75", "indicator--58107399-8b2b-4fbc-bf03-e03093b077d9", "indicator--bad7f93d-16cc-42cb-b303-fea265fb367f", "indicator--70124300-1957-4693-95b3-645a9fb23708", "indicator--b3add3dd-d3ac-44ae-aa7f-c6b90410f46e", "indicator--e4ca77be-d263-46cd-b7d4-a9f69624e1a1", "indicator--077396e1-3801-4b6f-ad3d-fed257876d4a", "indicator--f7d20051-ff28-4e1d-81e2-e5983b6be158", "indicator--ff2514f3-1f2e-45b5-8276-e047a1bd584d", "indicator--0567da39-f7c7-4971-8bdf-d870f07f6bcc", "indicator--1e94fd9b-944d-4be0-9a6b-1b2cac5ac29b", "indicator--7f9ff354-2adf-4b54-a5e0-2c4433f49210", "indicator--685d62c4-26f5-4d93-94ea-63c1cc1afee0", "indicator--c6b43ab2-d290-4804-8e0e-e4f9cced5145", "indicator--fa284c84-02b6-42bd-b7c2-a42ad30fe05e", "indicator--3cc4d65a-baff-4614-bd2a-aafa9f7775bd", "indicator--6a7482c6-2ea2-4afb-ab53-4d0624dd730e", "indicator--1f39e8ec-c322-4a3c-96cc-48629049285f", "indicator--c4d53075-adde-4964-b3cb-fa30e7bf6ee9", "indicator--9a7408fa-baf5-48cc-9744-29184d6bf468", "indicator--5623eae0-b33f-42b7-a7be-d8627409ab4c", "indicator--82f51d2f-67d2-4168-847d-3364887f9b10", "indicator--d28eb363-1f56-42c9-9745-2f2ae6ab849d", "indicator--6a48840b-cfed-499b-b9d1-7c5d31bb3f72", "indicator--37954cfa-8795-49b0-89bb-d56042263315", "indicator--86b6e557-891a-4366-978a-38bd8900d00d", "indicator--c7e803d4-7d6e-456c-bf48-1b407ffa26c9", "indicator--2db807ee-a5d4-420e-955e-07ce857a2ba5", "indicator--75141bb0-4aa4-47a4-bd08-44c21d9debad", "relationship--e5eb070f-5241-4ca9-8849-3c4601ad41bd", "relationship--1aad1f8b-7941-4798-808e-95a0060e5c3e", "relationship--fd07257c-6da6-4014-8bb9-59625613ccca", "relationship--dbaa54cd-b9d3-4ac9-b625-12ac25829c5a", "indicator--a9542e6e-6804-487e-a0b7-5c3090c8bb1c", "indicator--f8e116fc-8be6-47bb-a2e4-12c3aabe3255", "indicator--1561d3ca-34f8-4c4f-abb0-e2966e9002ed", "indicator--78f61c41-94f8-4ac6-903d-316ad8c434fe", "indicator--8ea9919e-a7e7-41ec-ae7b-394fd41b8d80", "indicator--78f739f1-f60f-41e0-bbed-3b685988101b", "indicator--092acce7-5b92-4a38-9f26-5a1d11b5525a", "indicator--51817b48-78dd-45b4-a190-aca4de1d0f40", "indicator--217c17c9-eff3-4ab1-aa57-6f1bd11fbba9", "indicator--11b34389-c67c-484a-9d4e-67c003c826fd", "indicator--a3de055e-3679-476e-b598-bc1aab948115", "indicator--f4cb7a55-f60f-401f-801a-630a204b6163", "indicator--1b191f29-195e-42fa-985f-3966a19dbc89", "indicator--c29b9ce9-890e-4b80-95bd-f6191c3d744c", "indicator--56b8bd63-cba0-49c3-8389-fdd6dd383903", "indicator--3116acc8-d001-4a85-b87c-ea091205cf7b", "indicator--04d17887-d118-4ef0-804f-868ce610a311", "indicator--f21ea352-7471-4204-964f-3174735d7723", "indicator--61897aa8-31ae-4b92-bb62-98a31febd162", "indicator--f43ac588-c8c5-4468-b6f6-5a5d3802f68f", "indicator--7c9d7ea0-dfab-47b5-8f4c-06b86f4184f6", "indicator--e308792c-d8f4-4f6d-86aa-230e216411b9", "indicator--c035d8ad-071b-4670-a029-ee6ce1fd59b7", "indicator--18e0f940-af21-4e40-8356-1c3089104482", "indicator--9f58eb68-e139-435d-b72a-5fbc70a10d73", "indicator--82954662-31ba-485b-b282-1cca5ba69d64", "indicator--e1ab0f09-4695-4619-83ad-aff6054f9847", "indicator--5b0833d1-4298-4e18-aa4b-27744aa331e6", "indicator--da7bc62d-8332-4437-830b-c39b93ad214e", "indicator--286312be-4fa4-43cb-85c7-c5c114b91673", "indicator--eace909b-732f-464b-afc7-403e189cf77c", "indicator--9af22944-3f3a-4073-9352-51eeedfa80e4", "indicator--e3b09310-3b4f-4fba-a3bc-65740cbf468a", "indicator--551f7973-46d5-4c2a-99dd-6e37dd812629", "indicator--ea23d6af-50ae-46dc-9c26-9031e8d89775", "indicator--ced548bc-288e-4dc6-b1bb-cc0ff4572259", "indicator--43657b0e-810f-4ea3-8ef0-24073e11b432", "indicator--94bf9cd0-33b1-4478-87be-dd74cbfb2cea", "indicator--eb77dce8-9bf3-4df1-9d9b-0b4f15bb5830", "indicator--e7bf32e2-abfd-4ccb-8e61-7cd0dd4fdd4e", "indicator--214dfaf2-3dc8-4000-8773-d6c26f526f9d", "indicator--395790ef-ece6-43e3-9298-0a7db9040485", "indicator--16971f00-eab2-4a5c-b3d9-600552287a74", "indicator--ba060711-92a4-4d9f-95ac-22b17c565fb9", "indicator--d30d793d-6ac0-4b48-9875-7c32f7e69b99", "indicator--4d3a3e83-384c-44e1-8eff-23fb65c8567d", "indicator--eb2f0dac-d1d3-418f-b354-7de65c36921a", "indicator--07832cdc-8e2f-4e2f-9a3b-0f4c7247c613", "indicator--18c90207-0b53-4f0b-933c-e21708ea064f", "indicator--2cf962a5-8c73-4188-a53f-6305a50f89ff", "indicator--3407ca93-7cc5-404f-a373-dbfda031b5e5", "indicator--c7d19b36-9215-4a92-82a3-0f503f97cd66", "indicator--3b13acc2-64f9-4917-951d-64bbe99495a6", "indicator--98427143-c3f3-49c4-9f74-e59ad6ab2982", "indicator--0bbee6cb-fac8-4555-afa9-172ffd387228", "indicator--2398c7c1-80bc-4fb8-81d7-5c3e4f4decf3", "indicator--c008a04e-8f02-43d9-a942-450668a313b3", "indicator--373e53b5-db81-4111-bbd4-6d45c4ee23b1", "relationship--479d4162-746f-48f2-93f2-5b6c0e11ce19", "relationship--9a9f48e3-bbd7-48af-98f4-2a8b4f0fffab", "relationship--57848cf6-cebf-4897-b115-6a5a5b6bbc32", "relationship--67433682-af9e-47a0-8f16-a94daeced74a", "indicator--d0718acd-ed4c-4340-b84b-9d1edf81dde5", "relationship--5be41ca9-dea6-4f49-859c-80feb51ac675", "relationship--6eee4d79-cc21-4ed0-bf11-d0a690a306c9", "indicator--2a92483f-d29f-4625-be9d-382b72482551", "relationship--8eda6b72-e4a5-49d6-8e8b-85a68aaf531d", "relationship--49800db5-2bca-4488-8032-8264a355129a", "indicator--edba19d0-0a6b-48d6-99ad-f67c9bd02afc", "indicator--b8ab7c3a-e267-4ebf-a07a-d981bc4213bb", "indicator--7d2a6a10-f57b-4eae-b92a-10a85f5c7de0", "indicator--b3cf9499-4420-4633-a8dd-edc316bca570", "indicator--555b6c4b-3637-4636-964c-a10f6a8b17ac", "indicator--17a03016-96c7-4868-8f42-0aff7da1d0af", "relationship--b881d44c-633d-48bb-8f85-cf4bb80e81dc", "relationship--075c40bb-72d2-4acd-9b09-31c900a0b330", "indicator--5a47bed7-e471-462e-a5fe-21b8aa579aee", "indicator--13b6accb-0dd2-4cf3-97f4-e542e6aba82d", "indicator--2fe0799c-532a-476d-ab1f-0aaea505a24c", "indicator--3655cb23-d494-40a8-9931-cd5078d8e162", "indicator--956144ef-88b6-4bb7-a936-695820882ff5", "indicator--644e2826-33a5-419b-9861-da2b3613a679", "indicator--bddec6c8-8732-4ad0-8468-090e73f24038", "indicator--2482e7d7-87e0-43b3-ad08-3f1adb1c476b", "indicator--f5c0d34e-bcb3-4bd6-b9f3-eb4b343deead", "indicator--a67728db-4fb7-4e93-aba9-2d60ccf152fd", "sighting--5d624fc9-c01c-4bd1-955e-791368093f59", "sighting--5c94c8f6-6d7e-47ae-87ad-812647e291c7", "sighting--c559937f-49ac-4665-8e10-4230365c6572", "sighting--cbe1b182-da39-436e-8c7f-6ced80a1172f", "sighting--dfce28ef-8b47-43fd-bb7b-6d648d3b6241", "sighting--08acdba6-5873-45e0-b17f-a3c014a734fc", "sighting--cba09c2a-c749-4ab4-8c18-f42800983526", "sighting--78468303-f9ed-4e5e-83a1-959d3fd51db3", "sighting--6ecfcef6-42a6-47c8-b1e4-867606e26277", "sighting--85c359f5-d328-48d9-a379-179e3e1e9a71", "sighting--5e4400d4-f7be-4455-8fc2-93467ca0431a", "sighting--bd189600-d331-471d-8fe0-d8eecbd5e37e", "sighting--0dfaf3d5-0840-4e9f-925c-1501724bbfa6", "sighting--831f993c-4ec9-4e9f-923a-7a423a6ab79c", "sighting--dac56cd0-1bd1-49c6-9450-47da3ff98a8f", "sighting--c4ba1497-cdb2-49d0-83ad-d20bf301ab02", "sighting--fcbd23fe-6004-4734-8185-bfe0bfa0049c", "sighting--21b7a7ec-3c83-4977-8848-dab8da048059", "sighting--745934d0-b88a-4080-9b8b-cad53268280b", "sighting--e5d62f67-f131-414f-bef0-814051971098", "sighting--32a3f046-bd8e-45d0-80d0-c8eb03e73be9", "sighting--66eba294-de2d-4a26-b7c6-024ded362662", "sighting--9a7b013a-29cc-45d8-a05e-21b594733b10", "sighting--a5838ff0-8869-4d53-a373-4f4871028ff1", "sighting--54d994d3-f583-4170-821a-978a13b5df7a", "sighting--c80610e3-ec2f-4de8-b63b-8cfc64a85fcd", "sighting--05dc639c-496c-4b27-9b27-413c48b1c434", "sighting--d399bd2b-9ba2-433c-bd26-9610c08c07be", "sighting--e96d3fd1-ad14-4ec3-85aa-0085cc1e90a1", "sighting--29ea4b17-a51a-4d63-b79a-d5d0b7bdd7cf", "sighting--e210a833-0972-4fbc-aac8-de0bcf04a440", "sighting--6180d61f-3adf-4c42-a0f7-6d2d6ee31925", "sighting--b13cd153-a3f6-4bd5-ace7-8600d8045493", "sighting--7f76b632-0130-49a9-8fa2-35c97ac4cd03", "sighting--a05feb0b-8b4d-407d-ac6f-706a266f57c8", "sighting--a600a20c-d652-45aa-a90b-3b5bdccb081b", "sighting--102768cd-4332-42c7-841d-2abfcfb07943", "sighting--2c9927ba-e2a3-4c2a-b683-6dfff20b2f18", "sighting--0ee5238f-7c23-4f64-a3a9-ff6a1e65b8e8", "sighting--6e5b86ca-ce29-4f42-b19a-9a43a8cf006d", "sighting--a27e4477-6385-4ce1-b5ef-e99ba8c8af65", "sighting--3950ec72-bce2-4680-8c13-9f7c3a4b50bf", "sighting--a40ebbcf-7160-46b5-a5dd-f23902c9fed3", "sighting--77c166a7-8dab-4c25-b2ce-3db9087e628b", "sighting--f43d5228-1eea-48fb-85d8-6a02982610c2", "sighting--9f45917e-6804-463d-a3a8-0f62c4909a31", "sighting--32cf3636-198c-4c7b-9838-35e5c526baa2", "sighting--f91e36b2-e1ce-40ee-9815-39fb31dd8994", "sighting--9461d6bf-dabb-4e86-b574-725684a4e1b3", "sighting--96d7938e-5ba5-4940-904f-6625e68ab935", "sighting--f2be3e31-c9c4-4a6c-8da3-952dda2b8601", "sighting--5f7afe27-da3d-4a35-b8e3-cf19c9f3dfc0", "sighting--c2abb473-2798-4e2c-942c-352d94d54872", "sighting--1de98e38-2800-4528-a842-905f10c5d0ee", "sighting--92dbb8c7-5f3c-4efd-a3c8-453e04374947", "sighting--8ae181e0-1706-4567-b2ed-2ccde31ab884", "sighting--45863f0b-71a5-4d0b-a169-4ee17d979e79", "sighting--5687a420-aba7-4937-a4e6-9405c93446d2", "sighting--a578e0d0-525e-4e86-84fc-0795c1530ed8", "sighting--cff9e3af-97a6-47b9-b67b-cb193272ed18", "sighting--20acd9a6-d10b-40ab-a7a0-f931065714f7", "sighting--b95ccb20-5c27-4a75-900b-c3499f968a6d", "sighting--874a2dbb-89ee-4c17-95d8-59da8d1488a2", "sighting--7da3a367-2ed2-42e2-8628-50090c746c6c", "sighting--1350833f-b2d5-4cfa-9879-c9a1b942b6d3", "sighting--72862aad-c9b8-4943-bb25-0e18fe9adca1", "sighting--3d2f0f2e-0a15-43ae-971b-fdd73ca35e30", "sighting--535f5656-07b4-4898-825c-26dcc119dba2", "sighting--b6520c61-eaf6-456c-a61c-542b61807bf5", "sighting--a53015d1-3b39-4f46-b147-aa6d738da1ca", "sighting--7088c4c7-e761-401b-bda8-3e7f830a2734", "sighting--639d19b8-d4db-4662-aaa7-9f3205ef627e", "sighting--14ba8321-a276-478a-a4ca-1fa2dc25ba6a", "sighting--f72948ec-1d40-474d-854b-1bd7586204fc", "sighting--940c8392-e1c8-480a-a8e4-e0d032dc2934", "sighting--43f9fcde-79f6-4fbf-8bdf-ce888722ef66", "sighting--78a715f4-835e-40b0-98d5-65af5642e871", "sighting--b6f2c53f-9de1-44ee-a3eb-9bcfb750d74b", "sighting--cb97ab7e-42fd-4ea1-b85e-5c53b2a181ce", "sighting--828032c2-f53c-430d-8991-35241f6df362", "sighting--cbb6314b-726e-40c2-8bc7-9b43930e30c5", "sighting--4b8ed70c-dc5a-4338-8aac-5159f8fa70d0", "sighting--cad22d35-fb6f-48d3-8d82-85b232f0de9f", "sighting--fc97f90a-5a2e-433d-a0ce-9456c2af8220", "sighting--7590b728-55f9-4c9a-a795-9dc63849114e", "sighting--6c4be396-95b6-4041-8cac-bfd71623529f", "sighting--acd8e6ed-f73e-4943-b92d-a2c821733b9b", "sighting--9c8fcb6c-2be4-45de-83d2-3db7ee2683c5", "sighting--e705408b-397b-4a74-9409-fdfccb4596fa", "sighting--89db6774-6e55-4cbf-99cc-88ef17684653", "sighting--7efbaa23-d0b3-4985-b0d8-960c2b60a87d", "sighting--fda4eb43-bae7-4c21-829d-988508d6ae73", "sighting--26f64cf1-91d4-4798-8c77-39128d456a1b", "sighting--569980cd-a2a5-4f0f-91af-cfee64b543e4", "sighting--0386a71e-5163-4fb8-8b43-d4ffd75eec85", "sighting--6bf1f817-2117-43c4-9071-feeef904fa92", "sighting--82a0c404-ed77-4308-a35e-cc4f64eb6497", "sighting--19621605-d169-42ca-9ed6-0ae64148af4c", "sighting--7e85dd59-99df-48ee-86d1-628c8fe42d97", "sighting--6376cf76-3d2d-4957-ab82-222f40bbe3c8", "sighting--456a6f50-13ee-471e-95a7-2bf7fce65bdc", "sighting--02d0762d-ab75-43fd-a1e2-6de213a4d928", "sighting--9c3e692b-d7ac-4f71-a7a6-a814e526d108", "sighting--43f95a43-6da7-4842-be6a-da5e223fac21", "sighting--d81b6d48-ffbb-4b27-b5f7-a26e34b03288", "sighting--67c7d50a-2690-4f7a-9c0b-60707696d911", "sighting--ef3aa972-277d-4fd2-ba5e-5d4b8b35a7af", "sighting--4842222b-dcba-498b-ae23-bc3e62622058", "sighting--32e2f07f-bcf7-4393-9603-87d3cbd7a50e", "sighting--4449ab89-117c-4929-9b59-94beacb9b27d", "sighting--3d2c1ce4-ffdd-4f13-a000-91b39b70e747", "sighting--86e47865-583e-42ea-946e-92a60ce9afcc", "sighting--8ae7b387-56bc-4847-9d42-c7a386296406", "sighting--a4a30496-967e-4a69-98de-ea681fd5f5ae", "sighting--6f836c93-eee8-4796-bdf7-d91f1fe90aa9", "sighting--00ab32c4-0a92-4869-846e-6734b4326dc2", "sighting--46248a15-ebac-47e1-817c-a2a54e0ab97c", "sighting--8b7cefc8-a80d-48a9-953d-2e46bc110815", "sighting--efec55f2-45ca-4a87-8353-9d16c01a9889", "sighting--242be352-c150-4154-9290-2fa3992fa85c", "sighting--e74b0b94-c2de-44ad-b867-69342856e6e7", "sighting--d3e804b3-e22f-4ce6-904d-c659e568ec12", "sighting--ffb51495-0261-4795-a64e-ce2e2be52f09", "sighting--7d3a55ee-42b8-4623-9f16-9fc3fddc00c8", "sighting--8d6c64de-1e28-46ac-8724-27823bbaa58f", "sighting--c7fab458-d1de-488b-b589-587821fbdec1", "sighting--c58942cb-1e39-4390-938c-5086a8f686bd", "sighting--97b14b81-55f2-4c50-848b-f4c5a24f4583", "sighting--30709969-f606-49a3-a9a1-8ae08f4d39a8", "sighting--db0ab063-7b49-4bed-b8e3-0778230c609a", "sighting--40f65416-f6a6-4eb0-9e9f-664f0c4f5dbb", "sighting--e6c53bf6-eb81-4dd5-9509-b17cfdd34f09", "sighting--00a37405-f8a5-4416-af54-fc9d7d9ec4e2", "sighting--703fd515-f48f-42c9-aede-36d425633687", "sighting--6c20fcdc-5b3c-47aa-9416-de043a11f915", "sighting--3943ab0d-f028-4d68-85e8-85ae12fdb40b", "sighting--7a132850-4ccc-4357-a115-fec026ba4e01", "sighting--4ca9ba2d-da78-4e4a-8013-ae6134d520cd", "sighting--37bf09a8-2ca3-4bdb-9a86-f25539b25b6c", "sighting--5cf37419-9b08-4647-b27b-8a99d7fae653", "sighting--2fff8194-5199-4ddc-a6bb-9233d35ccc21", "sighting--694a50a3-beb8-434a-9179-21898f431144", "sighting--974ef9f4-2715-47ef-9d82-f112e84d6fca", "sighting--5b65cbe8-0560-4810-8126-1a4089ff2fd2", "sighting--226436ca-13c5-4a23-90bb-b03b205424bd", "sighting--cc50d5a0-65c7-4b82-9ee8-72cf298f41e1", "sighting--80280725-6d25-4def-b971-e81a38e70790", "sighting--e27d23fa-67e3-4275-a5a2-93fae8235df6", "sighting--f03cdb34-e17f-4c5c-a14e-57d7d7e9c375", "sighting--fe683532-3aad-4c7b-9581-c419c85786ff", "sighting--256aefbf-fa00-41f7-b26f-c8aa19af70ee", "sighting--ce63d913-b1aa-4565-bf63-1f5c5b306fc1", "sighting--68ac718b-a484-4758-aa3f-0ea9bad23a4c", "sighting--afaaecc3-d011-4c52-b468-011b00561eb7", "sighting--44959b52-d6ce-47f5-8c08-3442622c7dbe", "sighting--d10ececd-6040-46d1-a299-f0e728dae3e4", "sighting--f74eb2aa-87d7-45a0-bed9-f08b73e12907", "sighting--839d87eb-bd54-4d8c-878e-62e87087e3a7", "sighting--26d7fbdf-9c97-4be2-ac34-0c9e7fc70a9a", "sighting--76b77b7f-a4cd-49e3-a6ed-36810f22a655", "sighting--cb2dba15-a52d-48ba-ae9a-d286389cff11", "sighting--138ec4d2-036d-4c5a-bfea-69b76d72faf0", "sighting--d6244e3a-c9d8-4e24-84de-bb1f7788395a", "sighting--a6a42c47-903c-4c8d-9941-83970192c969", "sighting--5c89ae59-a153-4e21-95e7-6ae4110eed3f", "sighting--947175d3-066a-47fc-b4a3-fd3a8da580a5", "sighting--e0736856-b5ef-4cad-ac7d-2e8e02e67ead", "sighting--70d8f18b-9af4-4ab8-bb97-ef6e55a5c83f", "sighting--6da4c8a5-b256-45ab-a49f-45947990a192", "sighting--ce5f5fa1-6091-4d04-99d8-0944cdf76cde", "sighting--7986e120-33af-4c63-a730-b599a43405ef", "sighting--7665f070-1526-4c19-b0f9-5ffe860f7d03", "sighting--e3cea4cd-822b-47d7-ab75-099b3435eabc", "sighting--45341756-79b8-4658-bf8f-18fb13d72a77", "sighting--37950b88-1f8f-447f-88ff-253559cd2d1a", "sighting--3ceec36b-cf43-42c0-8f98-9963bcac51e1", "sighting--3cd56eb5-d830-4bc6-a11b-63b3e9a6d152", "sighting--a0c595f6-523a-472d-8824-6f07d5521c0a", "sighting--ec5e653a-af59-4776-82f9-0f7d9bc1a299", "sighting--a70f1ba4-3017-442e-929e-9b668247ed12", "sighting--aec3f6e8-5c42-463a-9fe1-be9d8f550a35", "sighting--22e43a64-3840-4f9a-8301-5cec15cc5694", "sighting--5de0cb53-a5cf-4b9b-b888-1ac8aee2fa80", "sighting--4732ad66-0d42-4d7f-8904-5fccfdba36cb", "sighting--008dfe82-e433-467b-9d49-b027e317b4d3", "sighting--25ff33aa-222e-45b0-b460-3997ffe0ac72", "sighting--b3358f11-e6fc-4368-8d50-fd7d8991b69a", "sighting--8a55b697-347f-4727-88e9-a51b44666e29", "sighting--3d9ae538-f7e9-4139-85f4-85d740b7fff5", "sighting--c63afe8e-3ec8-4a61-9555-3d71bb8f1916", "sighting--39d512ac-79c7-4fc3-8a82-f24f119f2d72", "sighting--71307b7f-3d02-46b6-b15a-5e0cbc20d732", "sighting--619eaa48-9dec-4aa4-b3f3-7c2c143a1188", "sighting--dcfa3256-1b31-419f-b51b-79a05b0e22be", "sighting--72764158-149f-4953-8112-0cf41b79872c", "sighting--2dda80e4-8de7-4571-99bd-e408c6609a9b", "sighting--afaa7569-f991-49c1-ab30-44e2d4ce2dcf", "sighting--b501883b-e75e-4aa3-8299-585be781e97c", "sighting--7e14442b-55c5-4900-a6f5-08250db3c6b5", "sighting--7999ad79-65a3-436d-94c0-58412a829f30", "sighting--4bc4f824-49bb-42f2-97ed-23725937f765", "sighting--56835e7a-9a34-4941-81b5-a4e3d1404e50", "sighting--02bbaca8-0e2c-4031-95d2-48a126c0d485", "sighting--d7707adb-19f6-498c-a6f8-06fbc6b093ea", "sighting--c12fd073-9ccb-4d87-af81-c6660e1c6e35", "sighting--e8bc98bf-9709-41ad-aa99-66a90127a922", "sighting--2b4ee395-1065-437c-b45f-1f15f4ad08f6", "sighting--1fc44e1e-bcea-490a-9394-66f34e72c496", "sighting--be6753e2-ac01-4ecf-9335-58be6ecbb242", "sighting--070512e2-f3f1-4d62-a9fe-95a43346361d", "sighting--a3bbcbe9-66e2-4672-ab09-1b329e7947bb", "sighting--bd8d6ef0-cad1-4c0b-aa83-ba8df70b55b2", "sighting--93631f8c-b1ab-4bcb-9bbe-cb65749a9e25", "sighting--13613617-d1d4-4434-b2a2-dba3dfc657d9", "sighting--01172a30-1f2d-423e-849a-c363631797ee", "sighting--40207a0d-f5ce-4b04-a4ba-31ba7608c559", "sighting--b53812a3-23b2-413f-aa06-383f740568ea", "sighting--0314af54-fb52-41af-955a-ec4776702062", "sighting--271f87a6-8f5f-4e51-bc3f-ede6a5e92dd1", "sighting--49a61979-be09-4eac-8073-d05bf0659f81", "sighting--b04579ff-0050-4592-9620-9742e56a224c", "sighting--01608703-aece-4b1b-b91c-baec731101c5", "sighting--aa04dff0-7e7d-498e-8711-1b1ca4ed773d", "sighting--7d847a27-e83a-4ada-82d7-0bfae9bcd97b", "sighting--eeffc89b-17ca-4bb0-8997-66521c483503", "sighting--1a30c975-a3e2-446e-80ed-dccf39763e3b", "sighting--f3d40410-46a7-4017-9508-ba426a113661", "sighting--5176d846-388d-4a03-93f9-9e2b304b1760", "sighting--38598836-7a18-47d5-af6f-ee639f43970d", "sighting--d315fd37-ddd0-4799-94fd-44859bdeced5", "sighting--05ef155e-0571-4352-8094-5957323eff0d", "sighting--504cfda6-6260-44a9-8540-0ab65c2b904a", "sighting--85dd130f-ffb2-417a-9c53-f503c458e5fb", "sighting--5688b125-185d-4004-8af6-95897fdb8f04", "sighting--00814cf7-0529-4c44-8c88-6d0bad8b119e", "sighting--90589d26-22ed-4422-9fe6-26edb8287afb", "sighting--a53dfb93-80bb-41af-a0e8-20a405120298", "sighting--5dee39ca-3aa0-4ab9-a1d2-d31ef4982083", "sighting--639ec36c-8f98-4f6f-8fbe-fe3282e8c10e", "sighting--cd63bb05-1bb8-4e9a-bb67-b7027817457d", "sighting--4abeca7b-7148-4730-a23d-9b4523a0a90f", "sighting--ba8f0be9-d8ef-476b-aec8-148215bfaa56", "sighting--bd63970a-2bcf-469e-a632-27a105e9af67", "sighting--47ce9582-6d14-4188-8393-5c46fe87dec2", "sighting--f9d19a5e-c6a7-4a64-bdc2-dc5b59b8c7fd", "sighting--4a5ca2d1-e3ba-4baf-bcf6-ff2442ee1a62", "sighting--0f89d0ec-e9b8-4a0b-86c4-66431c39d400", "sighting--f6e51af4-bcdc-41f6-84ee-7d4001ed4f98", "sighting--4cbfe104-a6cd-4fba-b5c1-2a4d2e25629a", "sighting--5f432fb9-b467-450b-8f0e-d2b7a3329353", "sighting--0547317f-d788-4672-a7f2-a3f9e73f2f2e", "sighting--03ace83e-191d-474e-a206-eaf9fa7660f2", "sighting--ef244c03-862e-4dad-bee7-e896fc63241f", "sighting--93743749-4a75-4a49-8d9d-6ef985aeb943", "sighting--614b0c15-a516-4ad4-87ac-ded509131e7f", "sighting--e5be4e41-957c-4379-b2be-b8200939c4f8", "sighting--763411d1-830d-483c-ac18-d9875f4e33e2", "sighting--22516af6-35d8-4a39-87fd-0b4861c3fd99", "sighting--aa1dc10e-d973-4ebd-9365-87d4a2d3a59c", "sighting--f92230db-6862-49dd-9e75-f17e7c98c2de", "sighting--8b25188b-eb4d-4ecb-8cac-300fcd34eb25", "sighting--a3e98078-4c4a-41c1-9d46-058c419e6f20", "sighting--f407511a-f396-4a45-9ae8-d9bddee8aa68", "sighting--f0a2d5bc-92fc-4b38-9185-3c3ee9c0136c", "sighting--60dda839-e299-456d-8b31-d55b3f8043f3", "sighting--7c00e609-73c1-4827-aa40-9f4d5a21e975", "sighting--a51d757d-7d32-48b5-9316-4357e2ae7ddf", "sighting--4bda1a9f-98d9-44c6-8837-e310efea91f7", "sighting--e90f435b-abb9-4e47-8902-5a2c9e9ae99f", "sighting--0a824ad9-136b-4640-9cef-5ac35e63c1d1", "sighting--7484a5db-cfc8-4c04-8cfa-b99b5aade0f1", "sighting--31a71045-cb0a-4774-83f5-f04ba2bc81f4", "sighting--c80a501e-28db-4fe8-b77d-afb2a4ad3467", "sighting--165969f2-d960-42ed-827e-a1d885390c23", "sighting--9445f714-d990-42bb-8c91-e18b9fecd996", "sighting--62eb9fdc-8540-4bae-a13a-76beb95aa942", "sighting--4590bb54-0771-4227-96ed-8b0bfb9fb114", "sighting--8f7e4e90-9194-40b8-a9ce-7dcc4fc7ab0a", "sighting--72ab115d-8a2b-498f-8b2a-42f056034c04", "sighting--a7466ca5-12d4-4b96-814f-6b2d214c1554", "sighting--76ed9263-793a-44bb-b76a-c166e9b9334d", "sighting--e77245ef-bdb2-4412-834c-58bfd26bf98f", "sighting--1eded16d-e40d-4833-9953-c2cccb2da2bf", "sighting--e685d248-8f80-460e-bbd9-a5db931cdbec", "sighting--c6b0b73d-0cf9-47dd-aaaf-46a18c93e3e6", "sighting--42fc2e7c-c265-47c9-84f1-1932b29ab8a9", "sighting--6227b94a-be58-4393-b9a2-8db634e3ee5b", "sighting--1c4a2dc9-55c9-4819-8b8f-f0c275693bbb", "sighting--6f09638b-88c3-43ae-8741-1943bb7d826d", "sighting--d9c32a4d-76e6-40fd-a21b-57b3887d52ce", "sighting--43473876-7aa1-465d-8ec0-d593d076ac3d", "sighting--70c080c2-109d-46fd-8b58-f917918f0c76", "sighting--c7892291-cef3-4f95-b09d-1ec5991163c9", "sighting--b0d25cd6-ea00-4d00-8de7-a965d830f4eb", "sighting--861126a7-18f4-4859-8a2d-ef8cc79708a0", "sighting--5a010a42-7b65-4baa-a083-1259e87fbce9", "sighting--99c18d0f-ec7f-4a05-ac03-94e3b2ca354b", "sighting--26f785ec-4ad5-495b-a79e-8a64c18bf99b", "sighting--80015cc8-24c0-44f1-8b6e-5ad9c7ad91bf", "sighting--d9fbe83d-4436-4d6a-b620-78960ae4d20f", "sighting--8bedbcb4-3270-4838-b151-819cff69e2ee", "sighting--cc96cdde-d5da-4a13-a085-c6bd3cbeceaf", "sighting--14f98cd9-3929-4b35-b3d1-c5973035e3d2", "sighting--7d8c6d7c-e6f4-4d0b-b24c-68d5eeb56844", "sighting--370c5c18-bedc-4700-89d2-82bebac5d160", "sighting--13cd94df-ac62-4578-89b1-ec6813b8a636", "sighting--c4476584-57fd-448d-b901-be79e30e7d34", "sighting--73c0a385-f33a-4ec7-b2c3-10021618189b", "sighting--516cadf0-26ca-4b9e-988d-e09eee317744", "sighting--38eafceb-da17-473e-aa9c-c1bf69c0995a", "sighting--e73e468c-bce9-4166-9470-5370be6de3ad", "sighting--a6e65f85-4285-4d2d-8bb0-5d093a7ba17e", "sighting--83a11845-ac23-40af-ad58-1736dd1a97a9", "sighting--3159401a-005d-441a-82cf-8ed61729fe1e", "sighting--a0728579-1781-4dcc-8461-9315dc244bc4", "sighting--72bdfffb-5f12-4b3a-b841-2ba8b9169779", "sighting--d90b5e40-4f3d-459a-94e2-ef4864303842", "sighting--8e55435b-708b-44d7-b470-b0592ee807b8", "sighting--b960213b-cc16-49b1-afb8-907248818216", "sighting--9740707f-5ea5-4708-bfaa-3ffec9605110", "sighting--07a31650-f893-41ee-98b1-5853b630cfb8", "sighting--dca7caad-ea59-4e12-9240-dfaf6dfd02b8", "sighting--1ee4e1fe-251e-47f6-acfc-cae4e74a2111", "sighting--df558f05-f812-4552-a563-2ac436bb482c", "sighting--d63f5670-e77c-43b2-9092-2e00ac48e846", "sighting--d9d025c6-5f5e-4c6a-bed1-4de776efc8a8", "sighting--5ff30f63-9e96-42a0-9306-23d7e7e60971", "sighting--055778ac-9188-43e5-804a-fb2361e5b33d", "sighting--f3fe1c0b-93d1-4768-97a0-13bd9bc5042b", "sighting--956a4b93-fa18-4e4b-91d9-7d48f63c14cf", "sighting--bb54fb87-c5e7-4a78-879d-b000d83a5ca5", "sighting--6d4a07c6-df4a-496c-a7a3-ec7378afb026", "sighting--dbe881de-9825-449e-a48d-f3cd3147e12e", "sighting--1899dbdf-4285-4de5-904c-3fc4e16bb03a", "sighting--bfa0e672-6cc8-40c6-a4a3-dddbed90054c", "sighting--e9797db8-0c4a-4254-b235-f9ac095e104b", "sighting--9f42bbcd-d0f6-4ff4-af8a-0e98f70e7dd4", "sighting--ad248dc7-329c-4bbd-b833-ee38c89acd8c", "sighting--ebcb9fcc-c5e8-416a-a18d-50f6b8345692", "sighting--aa6661f6-fbaf-496b-bdd0-9c22c65d417d", "sighting--67f12565-8309-4d70-bce8-a172553ef1f4", "sighting--7f43cd70-4720-4c2a-b49e-a2c84a6dfc2d", "sighting--a966b82c-81e1-486f-ba54-9ad351d74ce9", "sighting--f4d8e5f4-fa61-4b3d-a2bd-9d52fd53a152", "sighting--074a0805-e967-408a-bb9c-c123d8006bf7", "sighting--92282216-b606-432e-8828-47c885c991d6", "sighting--15911508-63bc-4ef4-bc3b-a04a50433564", "sighting--8a9da19e-f474-49e3-9312-6a9274877897", "sighting--74fdf46d-3051-4467-9950-8c10b97ad55c", "sighting--e1a3706a-4a72-478e-a14b-8d4c549813b4", "sighting--56e83306-fbc3-4202-bc9b-e33d45759ba0", "sighting--8b5790d4-3377-4005-b7ba-b9b5bf661168", "sighting--43658e31-10d9-4e6e-8be4-736de558f833", "sighting--ea103566-43c5-4075-b4c1-07355c9bff20", "sighting--6cf47525-aa74-44fd-94f8-e36766fa026e", "sighting--6bc337c2-673e-4746-a3aa-4cec71b356ea", "sighting--6a28853b-a1e1-4fc5-904d-943da6cb05b4", "sighting--50ccd5ea-c0c7-49e6-9ea7-958569366a36", "sighting--9c4ac651-dd67-4ead-a7d4-64c98c5f62b0", "sighting--cf8fd93b-dba4-4cb6-8249-6929cbbea77d", "sighting--f019e6fe-d418-4341-8088-56f6175d5366", "sighting--b322f3e4-d565-45c4-9e9b-db1c9d159706", "sighting--8ffdb739-10f9-4f74-a988-a7e06963106b", "sighting--ed84d21c-d274-42d4-b182-6462d34bfa64", "sighting--e42dcaf4-422e-4f5d-8341-9e76792b9224", "sighting--f6b35cf9-3bfd-481a-8074-91ef78419608", "sighting--05d70ac3-54e7-49c9-a49f-9d5c7bdaf2fc", "sighting--fc84c49d-4b09-4325-9645-561975010ab9", "sighting--1b014df6-be0d-4abb-a844-2e5799412982", "sighting--55e1d858-fcb4-4d3b-b28b-07e8337faa4f", "sighting--c522c21a-acc2-4df5-93a2-f5bbfba8ae7d", "sighting--e4074336-6757-4eba-8f6c-339a0b8313d0", "sighting--e43323bc-0102-435b-8843-6cf8eec2b979", "sighting--f1978b82-53d8-49d3-a197-fed8748b4f27", "sighting--96ceede4-a0d6-4f2a-a9a7-6e43b7d0c0ed", "sighting--d4fc406b-44b5-4d1d-a277-d8cbb4975288", "sighting--b1620dd6-21f2-49ad-bda7-01519a198a66", "sighting--e1ec8b0e-cdba-46a3-bf72-8cea0ead94ff", "sighting--03490743-c10f-4e5f-8633-74f97a75e1de", "sighting--9653f1c0-6a01-460f-a096-77752a8cb843", "sighting--742dd54d-b70f-4a26-9f3c-b481acf9b269", "sighting--585eda00-db37-4c43-ae94-ea0a1d688a3a", "sighting--c8bd55a6-afa9-461b-9da6-e6ecf5843e54", "sighting--41638398-48a5-4f0b-89ec-f61239fd1d3f", "sighting--2b5c5cdb-d8b8-4b51-8198-9cad4c0f3c08", "sighting--cd8c7a29-9e0d-4932-8fe8-624255edaefe", "sighting--86420791-67d1-45d8-bdc7-6bf22df7f10d", "sighting--6faefda8-b185-4962-a05d-d206175fd673", "sighting--528935a7-6ac5-4660-b529-79bc65e286f3", "sighting--2ba93d28-4135-4dc1-871b-044b577c29af", "sighting--8a3e1acc-d405-4bfa-aab7-36a08d0475d1", "sighting--6d2df68c-610a-4dc3-8d78-0b8ad2a7444b", "sighting--016a29cb-767a-4671-a81f-05c551541839", "sighting--7bc542e2-7ec4-40ad-ab8e-a8213ae7a546", "sighting--a766ed98-569d-4eb5-ac59-3091030f97fb", "sighting--ea87ebc1-d5ec-43df-9a26-1bc660038f09", "sighting--8499dea0-4fc3-40db-8afb-2e3350f5f40f", "sighting--36abdee1-043f-44a2-88aa-63e21ef043a4", "sighting--5417c79c-b71e-4643-8d79-2cf81311cc94", "sighting--83492ba9-34f4-4fad-be2e-5be5a723539a", "sighting--ec14e8dc-fb6a-4ece-acfd-0a9a8616eb09", "sighting--6d98eda4-4ac1-4090-a98e-6ee0967d6064", "sighting--96198420-3521-4819-86d5-456657f87861", "sighting--12083810-edec-4a56-88d1-4d6190401076", "sighting--0b3f48fa-07d5-41ee-a30e-fef5e34267ba", "sighting--3192890c-7f4d-400d-9d44-d56ba4d27ee4", "sighting--a3d1309a-d90d-407a-8931-562a5f10d293", "sighting--4bbc6150-9f83-4057-9184-142c16291454", "sighting--5a438c1d-b574-4b3e-9fcd-36d026edfd9f", "sighting--4dd77711-8635-421f-900b-c9c1e42ad3e3", "sighting--6e1d8b08-2617-43e4-bc31-cb42a00d2b27", "sighting--04e0e28e-3159-467a-8fd5-a7250cb0fe2e", "sighting--55a6f789-3563-4cd3-961a-472f7d76ad1e", "sighting--21e1039f-e9ec-4ad2-bb69-c68315f9c7a5", "sighting--9b9221b2-83ad-4dae-8d24-6b81804922af", "sighting--ad61689e-85d0-46f8-9ed9-18796c55d0b1", "sighting--d1369b29-89bb-4a1b-81e1-e056dac1d7dd", "sighting--f77a4bcd-0117-40b8-bb96-5a7863dd22d2", "sighting--3392d01c-cd75-46b6-99e7-bd5a940f54ba", "sighting--f6f6e4c5-26d5-4aa5-8660-2785e09e869f", "sighting--446a95cc-6a6f-4c5c-854c-1e4fcc5828d0", "sighting--5e25dc9b-6108-493e-9120-18f9cfacbb8f", "sighting--8c212511-d213-4993-8b2f-afabb417ded3", "sighting--2f24898b-b7b0-42e6-8fcb-afa772e06478", "sighting--4bbf3735-4325-4fcb-8eb1-cb578dae9c20", "sighting--3cfb0951-a922-455f-9b91-5fb05098abb3", "sighting--e32dc87c-2a6e-41eb-8259-14016b053bc8", "sighting--f456b7bc-c5bb-4901-96ac-f77eaa060955", "sighting--d840fd36-9400-49c5-8475-a5d484c6b97f", "sighting--c621d3ed-3889-488e-b0c5-b27a1f76018d", "sighting--47803d75-5c73-4691-89bf-51d155f83794", "sighting--dc1e360f-a47e-4a44-9e01-805ccf20d24c", "sighting--35910e12-dfc6-48da-a18c-a82fe6d9d223", "sighting--7c9ebc49-56f5-4059-ace5-4122d698131e", "sighting--5676ec1a-6d54-4fb1-b49d-e32361e1b299", "sighting--2ae30cf6-50b7-451d-bea5-ac4d370b4904", "sighting--36fdeeee-f1f0-4769-b44f-702441c6792b", "sighting--3632ffe4-8d1c-4e27-94c8-774df54bf510", "sighting--b92305fe-6550-4c3b-b10b-0c0c856fa08c", "sighting--1f2235e1-1079-4a61-b9f0-5e5a271386ca", "sighting--e094c2f2-c591-4edc-bc25-891af626e75d", "sighting--ecb8810a-5d08-4be9-ab03-febc338978d2", "sighting--c353bcf2-97c1-4c13-98b4-f70a122b3010", "sighting--eaabcb13-70c7-453f-9d21-24bf635e3d4b", "sighting--458589a6-bdc2-4fad-a4ce-c3e490afc7e3", "sighting--5dfa732b-9120-46a5-a6d7-98f5ba892093", "sighting--40e42121-65c4-4c15-9cb9-595d24e66f17", "sighting--7b967a92-fc90-4bd7-8620-9be2de699e16", "sighting--080016a6-3a2a-45cd-ae8b-4a2ab27fe90d", "sighting--afb4f4c4-2ae3-4b5e-a0d5-a8ea3bf24ea1", "sighting--76a63924-867e-4943-8c1d-ed22a62b8630", "sighting--d0692fe1-ecc4-4b59-b08f-8bcead10411a", "sighting--4f778d2e-bf02-4d2b-85a8-6da89c7e3acf", "sighting--3fd78391-655e-4ec1-a96b-7da6931c1454", "sighting--8aeb5f93-299f-4757-8641-d0f42605576d", "sighting--3662e2b4-228c-4924-bf87-cea614f5d325", "sighting--1b7f158a-49fd-47ac-a08a-0fa562e13b2d", "sighting--6d8e35dd-1257-4491-aea1-cffbabe491ea", "sighting--124b9102-aaed-40ee-8561-ba95498cd9d8", "sighting--6db10013-53ad-4a08-bfaf-995ead3eaa9d", "sighting--68672870-c822-49ba-98a6-8e0c048fc2c3", "sighting--ae548349-ddc1-40cd-ad5c-fc705c148855", "sighting--78b2e5d8-ce7c-4193-8675-0d593620162d", "sighting--1be2549b-2030-41cd-8aec-b7ebcb612c47", "sighting--0eb875e2-0ea1-4794-85d7-05ae23f789c1", "sighting--8b551350-159d-49fb-99e8-df5ba8fbda48", "sighting--9af0cfbd-0f53-4fa1-839e-0ed8176f1737", "sighting--4e9466f1-ac13-4e33-bfcb-d5af061132a8", "sighting--fe998b7d-7ba7-4677-978b-593da07cc045", "sighting--c9a22a98-a697-4972-8892-511631aa2756", "sighting--e5cf915d-9d0b-45a1-87c3-659edac68064", "sighting--6de3de8c-3943-493f-b66e-e2ee589d5863", "sighting--08d63da6-c576-4586-afc5-6cce0b680474", "sighting--3357ef48-03a1-44cc-9f9a-9fa97bc7b074", "sighting--abd48833-5d70-41f0-991c-8d9778f98e7f", "sighting--5121f38b-3dd5-4466-9f01-3edb770ae876", "sighting--68eb22be-e84a-4b4e-8287-8cf6c571561f", "sighting--30536aa6-e03e-498d-a272-cff8f335d0c0", "sighting--e987d970-c4e4-4f53-ab7e-3ef8054f6b77", "sighting--810f96c6-fdcd-4224-bc9e-c818aedbf706", "sighting--6a67d285-f017-4d60-b682-0b2be4bfff52", "sighting--8e97aee7-a84f-4cd8-9711-d74932dcf3a5", "sighting--15f4010a-8a30-4ee8-b08c-d5322ee0359c", "sighting--2590b581-4b4b-44c1-b6cb-da9885a3867d", "sighting--b648856e-bcff-484e-8b9d-b1cef2cb8de3", "sighting--763280b1-af61-4c13-8382-00a995a3f972", "sighting--69e7ada2-3692-4aec-a473-7a8b6cdbdeaa", "sighting--ffbe0113-aaa9-411c-8a83-392ac494f11e", "sighting--c555a932-84ce-49a4-acb2-3371b71b6d5b", "sighting--c789b809-3f16-4a69-b967-15d80647f73c", "sighting--417e67fe-518b-4115-977f-b7d41f911b5a", "sighting--ed33febb-04b2-4cbc-8738-1f8c5c4f7b61", "sighting--bfccdfad-934d-45a8-8169-8198ac04d10f", "sighting--cb814aec-20df-4f35-b0a6-95f5be4126de", "sighting--7f7b7447-35b4-40ca-a631-e737265685b8", "sighting--3a83d58f-dc9c-404d-a8c6-284b2e42294c", "sighting--c57c3dcd-275c-4211-8f1b-0ebdcafe7cea", "sighting--f0046112-7b86-42bf-9e93-ff669877a00c", "sighting--8a2c6d0d-c7f5-4a7e-8cb1-58345ecb2071", "sighting--0e904aef-2194-4c5c-a3b6-966271a6d243", "sighting--45a36e6b-368a-4980-9ad5-41af9aa3b184", "sighting--269537d6-8d1c-46ed-bccc-d02779641dc2", "sighting--81e35447-b088-4635-958a-8cdb4f98fc69", "sighting--f1c71d56-eae9-4de2-81ea-97c04013ecff", "sighting--1511263e-3112-4463-bf0f-896baab481ad", "sighting--c29745e7-c9ac-42bf-95c8-3c0c21d4f38e", "sighting--4475ffc5-1d83-47f8-b790-7630508d5d07", "sighting--7f6a2c82-f6f6-4253-aa62-b968ff70915a", "sighting--f3b95fc3-ba16-4c7c-903a-b4be5b7e9efc", "sighting--be5d81df-f702-4f5a-9e4f-56091343df15", "sighting--b2f76d51-2632-4a39-abdb-cfcadbf18859", "sighting--848e458a-4ee2-43a6-9230-ec28097996fa", "sighting--84715713-12f5-4713-840e-ede8dd38094c", "sighting--e019e3d7-cbb6-4497-a50a-3e797c5ca97b", "sighting--ab511811-7177-4e83-8606-c22ca2e5e8ea", "sighting--e2e3abc0-c886-40a4-b887-54960cd938f2", "sighting--6607195d-610f-480b-a94d-22dd7746e8bf", "sighting--f1478e03-1090-4654-9a9a-3039932051ca", "sighting--d21bd16e-bfa2-4aea-b312-f974abdd8e48", "sighting--20c0ebc6-cf5b-4f8e-beaf-6c3d6f270b44", "sighting--de6e7d96-d860-4617-97ae-be7b55ea359a", "sighting--4ade759f-e537-4d2e-90b5-777706e6dd8d", "sighting--7ad9604d-5f63-4aa7-8737-95abea2c1a9a", "sighting--de9af661-f917-4859-9067-48ee5fec5836", "sighting--d2033af5-740d-419d-b516-c03359e0dc1e", "sighting--7313eef1-f148-4d11-a594-a83c784e05b8", "sighting--29303e63-93a6-42b9-a192-fd09b203e5e2", "sighting--3e75f74f-f884-427b-91a2-66a6cba0bed0", "sighting--b9d19371-c26e-4cde-b219-862ce00de936", "sighting--c23db0cd-7cbe-4af8-9d1b-170c5d69dfdd", "sighting--84b33b47-bc9f-440c-b3b8-87714045735b", "sighting--47461582-6e9c-4170-970e-8e70bda1ab35", "sighting--3d416540-1277-40bb-abb0-661919183d3e", "sighting--71b16b02-e165-4844-a4be-38879cb48123", "sighting--17ac3814-a84d-40da-a339-9df639cb5324", "sighting--dee1bc80-a8a3-4d69-8221-f1021a649d7c", "sighting--5ecdba9c-0e12-43b2-9d26-8c3d6ffe30ad", "sighting--31f441ec-e637-4576-a966-87e3c0bb2a3e", "sighting--0a25e8f1-500c-43c3-a2c7-4ee65f8ec414", "sighting--9afd3e61-8b08-48d6-b791-e076fc0dd47e", "sighting--57b7936c-1149-4eba-981f-713ad4c3bc5b", "sighting--0daa821b-533a-47ae-8d87-dff1737e1c8d", "sighting--d7a784db-bef2-499b-a81d-15fc79e3421f", "sighting--b859dc3c-de59-4696-ace4-c2fe692d8010", "sighting--e3287f1a-69e8-43b3-ac95-78d23246c014", "sighting--d15d0674-9704-4499-b77c-ca1a5c217567", "sighting--ee0bad0f-2691-4493-bc8a-7a2150cfb76c", "sighting--2f39c77b-abc8-4453-90c5-c83956e305a4", "sighting--7a063a8e-caec-4dd2-a18a-86e19a932724", "sighting--6cb040e6-3944-4992-9b5f-ea8402ec520f", "sighting--91f464ed-c1a5-4ac2-88d1-bf30ad878a22", "sighting--0b392925-2610-450c-9ddb-8dd48566643f", "sighting--07f6128f-9715-4bda-9dac-09edb905fbd3", "sighting--b45b3b50-405e-4b34-9da4-b470ff6ff393", "sighting--44575926-1fca-4f15-8392-020be5dba172", "sighting--da12ac5b-9fe9-4047-bb48-928601c151a6", "sighting--46bd5bdd-66c6-4cf8-88f7-19aab9eea7ea", "sighting--70dcc56a-8e6d-42a1-a997-dee38d375168", "sighting--0fe68cb1-14ea-43c4-9d1c-b2a053e484a2", "sighting--e663f05d-2ced-41c8-a7a1-ac88294e3f5f", "sighting--d530926f-06ee-46f3-90b7-e38cebc13bbf", "sighting--4cecc4cc-e924-470f-ab51-67d566bea63a", "sighting--31aa026a-0ac8-46bd-8c39-e6950404efb9", "sighting--1838c642-b882-43e9-b669-f655aa8ae779", "sighting--c036a5c2-eba6-42ac-a940-d170fa1d7d13", "sighting--4cc85bc2-b01e-4d3f-8919-63c53123d05c", "sighting--41ccc228-5a1a-4d5d-978c-64e07dd525cd", "sighting--d8300eaf-53b2-4e2b-8867-5e65e7bdd956", "sighting--cff07cbf-b88c-498b-95ea-c248bd63d974", "sighting--b399101d-0dac-48fc-a67b-1d6a248a63d6", "sighting--87e87846-bb69-4c13-8d52-5a962f67b73e", "sighting--e2624666-16af-4acb-b0ea-07b1d169bec9", "sighting--f68a4a03-49e5-4727-ab32-4ac74dac39f8", "sighting--667e8c73-d1a8-409b-8f5c-1b9fb4fdfb2c", "sighting--aac5e5cf-31bc-437a-8314-f3642158db0c", "sighting--5913147b-a0be-48c5-b2b9-7e99b0be8b34", "sighting--30d50daa-00b5-4967-8f52-eb38ea223773", "sighting--be717c58-e48c-4081-9678-b97bc8de733c", "sighting--ef9f754b-8bc6-4aae-b790-3f81824a4ca6", "sighting--ae24f543-97ee-4f5e-9bd6-dda5095f93b8", "sighting--dca5b50f-1c84-4ec2-9dc7-ec6521c2dd7a", "sighting--0f7705f9-8a41-46cd-818d-0d11ca7cdea8", "sighting--78e235d1-be7c-4017-9447-f599250eaf84", "sighting--9032909c-cd9d-48cf-a10b-3df0724a1325", "sighting--76c44051-f4dd-4032-97bf-3e57a5bbaf42", "sighting--1fec4e09-9417-492e-ab4d-571d48d543b1", "sighting--a86e2cf3-7ae9-4b08-a564-3baf6e815759", "sighting--1ad38ad0-4056-4910-8559-3f0c746d65fe", "sighting--d46fd4ae-99e1-419e-93c8-7d17f5488d09", "sighting--295efecc-6a31-483c-81dc-7eb2446dabd4", "sighting--030f377c-9c60-43fe-bc75-dafd6efad312", "sighting--7303e78b-18d8-49fc-928d-d507756ed0de", "sighting--aac63a91-5ace-444c-8b7d-a0a2390ea84a", "sighting--55a5e8a9-38f2-43df-9502-cc51db074d9d", "sighting--e506dc39-82a4-4f7e-80e1-d519d61341b2", "sighting--d971bd01-3f50-4d6d-9398-a895b9c01dfe", "sighting--4ee8a0e8-78b0-4977-81a7-88c539c2f711", "sighting--a4e014aa-04ad-4f75-9f04-f4aebb2ca382", "sighting--b4008ba2-4787-41d3-884a-fdf6016db4a7", "sighting--cec17aa7-729d-4def-a0c3-fa86081ef124", "sighting--c28cf22e-39f5-485c-8a4f-e97925a96938", "sighting--30d07d7c-0c83-4d65-8fc2-5cc2cddec378", "sighting--e088dd88-fa56-4173-858e-bf7af345b9b1", "sighting--23c94702-bfd3-4706-bf48-e64224632ed6", "sighting--c12f9162-e86d-4f87-8839-549cf9cd9ebc", "sighting--9622068d-27a0-427e-86ef-d7bf15adaf2b", "sighting--f599f01e-73ab-41a8-9a83-c18bf420fefa", "sighting--3282a6d0-589e-4c6b-bd56-4b62b3ca5b07", "sighting--9334c996-df57-4af9-8c08-6915b7796a77", "sighting--bcd9ee8c-1e1d-45d6-8424-a1f60593fc3f", "sighting--d2654792-3816-4673-aca1-4c8e8192f038", "sighting--f7f7d7a8-9d65-4a5a-ae32-2760afa11df4", "sighting--c0bd5bd2-753b-4d57-a2b4-e9669ff19622", "sighting--d0836c75-bf0d-435b-9e8e-50a1a4ee3630", "sighting--cfe577e3-c92c-496b-a92d-5b3b07b63623", "sighting--0d8e82f3-0b72-4f07-bdcf-81b4f75692e0", "sighting--ff06e5e1-3d3a-4c0b-a52b-29f82ccdfced", "sighting--943932bb-a4e2-446e-bf72-b5150b574fe7", "sighting--f9231c62-f278-4885-980d-8d3d4b1872fe", "sighting--b1ae91c4-3b67-41a8-b900-d698de044def", "sighting--a1c9b90c-b52a-4313-acaf-f1115d978291", "sighting--7a0e020a-6f1f-4dcd-95ea-2d9d312a088c", "sighting--e0e29879-6f8c-4d31-adcb-2e69d61251c2", "sighting--95f9063f-2e96-46eb-b729-42314813f4e9", "sighting--4967d7fe-a08f-4937-be32-870397e2651a", "sighting--4c74f8a4-293e-46fa-8cc5-9be348793986", "sighting--af1ad3f2-fc26-4e28-b01c-8303f31228db", "sighting--42dff126-6312-46cc-952a-36e422e2da2b", "sighting--e508bc52-f4a2-4f8e-bae9-25afba08f949", "sighting--fc0a261e-addc-4329-8e43-b58fc3316bd8", "sighting--57b6a8da-3308-48af-bb90-85435652d459", "sighting--942ffa5e-d868-4e6a-8165-4b8cfd6da7a3", "sighting--da05cead-45e7-43f5-8554-f44bc996faf1", "sighting--26785cb0-5735-4652-ae1f-87848fe41a63", "sighting--3c071b45-c936-4f69-9ff6-d534c9e113a9", "sighting--856a23e6-cd29-4cc5-9422-4eb1b387a493", "sighting--e356f3a9-20ee-4fe5-b773-3a3f80045cda", "sighting--c439ea4e-e7a6-4dde-82e8-1744bf11cd52", "sighting--c4a2613e-bd26-4a98-8bf1-4c207c334d08", "sighting--e9ceb825-2e0e-45c3-9e2a-e5a3331c500b", "sighting--d260adf7-82ed-4083-9f97-ddb6d75f853b", "sighting--0c9a2728-e22a-409c-a8ba-3e346aa98182", "sighting--1a9ecc3a-8e42-41c2-b21a-6c5aa8919334", "sighting--89b33cdf-5950-42ec-8e8f-6ef0cc4ec555", "sighting--43b10ab7-0562-4f79-83fe-15ad46adfe4a", "sighting--3b4d6d86-cf96-4822-92af-269ed7f1f846", "sighting--4d74e2db-82f5-4ac5-935e-d89844065328", "sighting--623afb52-c8df-409f-bf2b-d7acea996c33", "sighting--bbcf4904-5a33-4083-a807-9f690d400e38", "sighting--021c0a2c-8263-4231-a564-31c92ed82cd1", "sighting--0bbe0a36-bd63-4cf5-90b1-86c330c4dc32", "sighting--cc37c7e2-a82f-4694-8b65-60d8409eb6c0", "sighting--57606422-2059-4c9c-a8f5-aed6421d55d3", "sighting--1df75a8d-6f26-4435-aa80-d65eecc5009d", "sighting--ec60f605-9fcf-494a-aa12-371ed3f83970", "sighting--5f96f332-0ce0-4796-bc42-637b4924dd73", "sighting--adcc2e62-cede-4050-b95c-8968ed1729b9", "sighting--85fbe39e-f0cb-4a87-8cfe-c38efa9f8cac", "sighting--42e0f1e9-f98f-47c3-8a92-e3a9e49fa87f", "sighting--d7e4717a-c731-4727-a515-cf65cbaaa53b", "sighting--085490e5-d1ed-4a66-8291-e59e173b55be", "sighting--84f0cbd5-0f52-4118-9792-f57f60f88f89", "sighting--8562ea6b-20dc-41e4-9d82-b57a160b4b42", "sighting--49f61dd4-f3da-4760-8ebf-c93376b24957", "sighting--4dc7cfce-ffcf-426e-9094-ac5aa1ca2375", "sighting--6f60c69f-bfaf-4ddc-b07a-62247101eab2", "sighting--16e2d2a0-66f9-47c6-87d9-d632f018a8da", "sighting--1d9ad5cf-b276-418d-b84d-408daec2c284", "sighting--9d68baa7-17b6-4a0e-b0a5-10d4017d409b", "sighting--3557bf92-5083-4379-8861-6550ec763112", "sighting--a16390b8-d0f7-431e-b606-59dd860087a4", "sighting--736abef2-edcc-4cd3-b1d3-be8123b3a436", "sighting--77891413-0fdb-4bac-b4d9-751ca73dde31", "sighting--6672f55f-74e0-47ec-a757-751e0f9223da", "sighting--55d63c68-f3fe-4319-a6f0-a9de9958c651", "sighting--4f071b27-2bc1-4e28-b47d-e947a073515b", "sighting--e8d116c6-0703-4bb0-9046-95c3af99fcb2", "sighting--27c626f6-dffa-4f84-89d8-bd8d0d515766", "sighting--e45f27bf-58f7-417f-8f5c-2fbd112d0b22", "sighting--e9d1019b-e57d-46d1-84cc-0ddd718540ff", "sighting--fea60672-86e3-4bcb-9358-82363454e037", "sighting--560fb361-654b-4954-8058-76ca986ded95", "sighting--2b63c0fe-40dd-47fe-8daf-9e369ce4e159", "sighting--bd8ef629-a0d5-4243-be3f-a9171b4df5d6", "sighting--2f24914f-a64e-4975-a063-a96ef4375af6", "sighting--f36ea711-1785-4d32-aac5-22c53942482e", "sighting--bafa725d-77e1-4e2b-94a8-50392470e1de", "sighting--e6eb3bcb-1c0b-4574-afba-7685268e51d2", "sighting--18f88ece-da59-4262-9e62-aeaf28baaf75", "sighting--e548f80d-9a70-4ed5-9e57-896c6b5fae83", "sighting--9cc86852-3b41-4aa2-867a-73c4a4500f55", "sighting--7b06d8ac-e765-40e7-9b9f-b825be4f9ca1", "sighting--c204f9f7-deb5-4e81-be26-c29de1dc84b1", "sighting--1a00abfd-e47b-42b9-b890-bdd5b2936950", "sighting--2fbd32d6-88dd-4c89-a007-0cbec8681bc4", "sighting--825e4c3d-c4f0-44b5-b17b-8d38cf362302", "sighting--4a6f5a5d-73a4-448e-af8e-fb94b0868507", "sighting--a2097705-328a-46e9-9534-cb98ea7359c4", "sighting--c88e3189-a9d2-4673-a49e-80bd2d26ae1a", "sighting--70909ac0-26ac-4d9d-a0eb-69de77f0328d", "sighting--320801f2-45ef-4410-a8c7-cd2c5a389dc1", "sighting--480278be-3545-4105-bdb0-51827b8955a2", "sighting--310eead8-7377-41b0-bd07-bde757e293ce", "sighting--98b0bb28-9b6a-4ce5-ae1a-01506c8c3a8c", "sighting--8266e059-8bff-4790-997e-33e981b01e7a", "sighting--cf88a3b2-0343-4282-b493-d809fc31513c", "sighting--e57a5bcb-aab1-486c-8052-1c2c924846df", "sighting--4739c361-7877-48e6-8369-1e4bd7e723f9", "sighting--c2aa28da-49f9-4a29-917c-f35e083feb4d", "sighting--67b7ff38-7b42-4f53-8a58-9083f19d73a9", "sighting--0bba5727-28e2-4162-8a8a-617985c58086", "sighting--5a2c47fc-58f2-48a3-8ad1-40ff4277ed68", "sighting--5af52742-9c0c-4559-96b8-b7f16fd959f4", "sighting--17495fa0-5e30-4ae7-acdb-1f80e1fc85ca", "sighting--a5df86af-8d3b-41f8-9410-cfb8cb1aaf53", "sighting--c7863466-a1bd-4337-a5da-e4e129071534", "sighting--5e64cb47-f920-4671-9e9f-e5dac6a9fb40", "sighting--b6aaa405-b064-4d7a-bc0c-1115194a8daa", "sighting--815d978e-6d14-41ed-98e5-a3f3d1f34e44", "sighting--73e4b932-cc89-4e28-937a-72c09bf504d3", "sighting--d967eabf-2354-429f-81fb-2042f1615353", "sighting--598d7c7d-d735-4d79-b3ba-194e89edf014", "sighting--e79f1eb2-3ebb-42b1-b31f-c96232bd7fc9", "sighting--99d8b078-ba83-4af4-b680-a1d33e26df31", "sighting--1dd900ab-80e6-419d-b7eb-68dcae578e8b", "sighting--782df6f9-384a-43c1-86bb-f40a3a4e6ab6", "sighting--b53a1b6e-3830-423d-b3b1-bd35aa58a913", "sighting--7fe519b0-4de7-41e8-bd54-ce38845cd468", "sighting--b8d6c07d-04d9-4005-8915-454689c27dee", "sighting--38d5366a-fb01-4a0f-9dd4-d0d691960b8e", "sighting--c654bb77-b181-4a41-b487-cf77b261f46e", "sighting--7c663a04-2c5b-41ce-a2b4-0b37ebda923b", "sighting--16acd393-1226-4101-a9f6-6677433b2aa1", "sighting--12723f95-5879-4c22-b65c-7a57cbb5c31f", "sighting--9135e3cd-7add-41a6-b5c2-172e11b840ec", "sighting--8a590941-826b-4052-aece-ed833d030ef4", "sighting--e072cd4a-2d07-45c1-8dae-3720704f0645", "sighting--d1217d4b-dafd-4172-ae54-7e3056c314e1", "sighting--60230711-b29e-4d89-a90b-2cac18289962", "sighting--07e8f0ca-385c-4045-9701-e374c7ea2e77", "sighting--cedeb8f5-9cc9-4d55-a8dd-bf84467d816a", "sighting--f17e321b-8120-4329-b584-df01731bb67c", "sighting--d39be9f4-ab1a-4335-900c-fdeeb484665e", "sighting--ea311d05-8644-4a38-af95-180f8e2ef327", "sighting--7d33b37f-0ed2-4320-b907-35026f2900b9", "sighting--22eb621e-17df-467b-bb03-035a87b9cbdb", "sighting--47ee1538-225a-4c53-864f-60bab144b4b4", "sighting--451e5e4c-6f13-4807-8982-5e03c4c5cdab", "sighting--e3bc5405-6cf3-4de3-aa0e-9b01cbb80bae", "sighting--9e647c49-a00b-4558-ac2b-9a7dd3f9d4a3", "sighting--c17aa9a4-f90b-4e01-a2ed-1ff46a20287f", "sighting--478c89e7-d71c-4cb2-8475-225e55335b22", "sighting--73f30103-a8e1-4cfd-a5de-f536089d1bcc", "sighting--6459bade-92b5-4291-bfa3-b98c38b8513c", "sighting--27e9238a-12aa-4834-8ea8-7af021b1a6c1", "sighting--a284e181-ae20-40ee-8c94-ad93f978aa33", "sighting--4d6294a1-fe73-4a37-b049-92382f23073c", "sighting--7f7e51f6-b987-41ae-8ccc-a87f3744fc43", "sighting--0d4d4734-4f8d-48f0-a788-8225ca1879fb", "sighting--bd6febf0-6281-43fb-8c4e-568817afcc44", "sighting--a8e3229c-da72-40ef-89ce-379795ad4646", "sighting--6c59d39a-6905-48e5-8623-73373bacb4a1", "sighting--a57fa6d3-ef65-4214-b5c5-3da59469cd3d", "sighting--43f1f185-402c-4a17-8951-79475438f32f", "sighting--32e75f59-46ae-4056-b6da-c489a562c6d3", "sighting--9fb44ded-ba46-4baf-96a8-a5bbe4b1d3dd", "sighting--6c4a9c13-2a86-4f59-84cd-5f177ed6b314", "sighting--b6fc6728-528a-4f58-8af1-57241beb5e34", "sighting--169eff80-4297-42e1-8ddd-87bff2106b9d", "sighting--c4802ca1-e579-441c-afeb-9eaa3bd3366d", "sighting--8680592f-2f05-46e3-b79d-f9451bf96192", "sighting--d5c55f25-1a45-4b25-a678-9e555639117e", "sighting--99c419d7-6b19-4ace-9c80-538a3a3e7b91", "sighting--d8a9a728-eec6-4e5a-b1fb-9fa95fdd5fd0", "sighting--7578e6b5-5f21-4887-848b-909f223a604d", "sighting--3c3e7574-b3e3-4dce-ae0f-b69a0e6cf512", "sighting--2fb0de07-4c7b-403c-89f0-bcae8b60a518", "sighting--545b949b-f44b-47d1-9a3f-80b815318e97", "sighting--e9796fc6-a18f-4827-a3b3-a4c38d51a319", "sighting--c82b538f-1d51-485d-8cfc-402f52d1888b", "sighting--0155f0ae-05a5-4690-b05b-4a6f380f6a79", "sighting--b2de8573-f00c-4b39-8cc1-b87db2a3588c", "sighting--ad40ff5b-13ae-4cc9-9518-77109db0c4f8", "sighting--1c98539f-fe0f-4add-909e-b21d67ea3dfd", "sighting--e7eab44b-0c3b-49fd-a45c-e315cfaf2708", "sighting--21555598-d16a-426d-9b1d-cb0a48b9b863", "sighting--84f65d74-2f64-4dd5-a3de-d121cde49b13", "sighting--550a68bd-b6ce-489b-bfcc-e63b7ef30791", "sighting--0ab6cf69-0045-42af-899c-8056affe2679", "sighting--160fde1c-a62e-4e25-b9bc-b8354fc982c5", "sighting--a19aa8a3-7eac-4400-aa45-47795c9e3c4a", "sighting--00d77f17-268e-464b-bc38-b86820991ace", "sighting--f99458be-f3e7-4fae-a426-68712858cc13", "sighting--9fc49e04-abba-4c10-9b77-f509a2916dc4", "sighting--52a7ee88-0bbe-49d9-b026-8f049dec39ab", "sighting--b80c1731-33b2-4c0b-be1f-c3be02a6e2b2", "sighting--07bf2434-e787-4e33-be86-f6719cc8d97e", "sighting--0ed740a1-48cb-4bfa-a0fa-15693dab1484", "sighting--d11ebf0f-8e3a-4d74-80a0-1a3066aa5487", "sighting--846d74db-2ab2-4da5-b015-1b8d4a610911", "sighting--2daf0a27-8302-431b-a625-abe6be5ba6b3", "sighting--2bb693ef-fc11-45f4-993b-dfa298e76fa5", "sighting--7ed6d107-5f97-4c56-a5d2-fe90f129b803", "sighting--800c2908-b59c-4fd6-9d52-2b6a052bcc72", "sighting--9f893056-9f6a-4e75-8e58-d76cad0d8f7b", "sighting--1deae2b0-0265-47fe-a379-d35293308afd", "sighting--b1de5180-ff48-48ee-9f9d-54f5285828f9", "sighting--9ba2d878-e262-4707-96d4-49ad17e75573", "sighting--f111743f-c74b-4639-8964-ddec32fd63a8", "sighting--ed5d373d-ab6b-4e00-876e-e064b622406f", "sighting--d2e9cf0d-c3b0-494e-9ae4-7b29e938838e", "sighting--bc77e709-8616-4a80-99bf-fcaa83806877", "sighting--54fcc943-7142-4262-97dd-67fe73745730", "sighting--696a667f-7ccf-4a3b-90bc-37cf372f337d", "sighting--d34257ca-de30-4096-870a-23763b00b989", "sighting--ae2d645f-4a3e-4345-94af-212e01f7ead1", "sighting--14ffb775-5d76-458a-8f66-8555b6eef688", "sighting--2f1d85c4-7cfa-41dd-9133-97d7c90cade8", "sighting--580f0193-1110-4130-a194-eda1a8181ed5", "sighting--53f02e6c-f0a4-404c-9393-dfb616d76717", "sighting--e6a91ea8-f703-49f6-8e19-d04d1c62a31d", "sighting--5e22cec1-850f-4642-9b88-9b8a98f362ab", "sighting--35b2ab97-a3e1-4cf2-b54e-fca4de9e94fc", "sighting--d8638347-9054-450b-a945-464ced1697ed", "sighting--7d184d1d-45f8-4106-af67-5ab86845fd6a", "sighting--5939ed7c-1e26-4bb5-80cc-ff768778b19a", "sighting--a58fd772-7393-4c4b-86ba-9bb3fdedecab", "sighting--5401df4d-2fb9-480c-90fd-9893df3bc8af", "sighting--6691e59c-1a1e-4ca2-87c2-0fdc686a4ba2", "sighting--6d171d18-5078-4017-8ef8-9e6308e31196", "sighting--3f3c7d6f-803d-46c6-934b-2b0ec7e01829", "sighting--52904c54-4004-41a4-8825-28dac4454296", "sighting--b76088df-0122-4901-8dcc-d8cabcc14f1f", "sighting--343e9fe4-09ae-4073-bfe6-4690ef24af67", "sighting--451eafae-d105-42a7-8d11-dfcd17bf0378", "sighting--e3412b0b-42ab-4d0d-a61b-ff7b415079b2", "sighting--bb11103e-7c63-4738-a4a3-d42997c1a90e", "sighting--cd1c47e6-3c5f-43f2-8b84-b7d1f3060239", "sighting--c906a6a2-cbba-4f98-936a-871c9f10ad7c", "sighting--c78b5e7e-7ad9-4c77-b0f9-a8a562e0c45d", "sighting--c97bfb5b-09fb-401e-af3c-ba547525eaa0", "sighting--f81371e7-799f-46f6-a60a-a612491e0943", "sighting--0b2078ea-b87a-4cc1-b102-98240bb8c5fb", "sighting--c07aa61d-6092-4da8-b989-7ad92e48afb8", "sighting--fbe5cd16-fe62-41a0-8a32-be71b2e7f696", "sighting--1380067e-4032-4f5c-9dd2-26ff199bb872", "sighting--befebe5b-5733-4bd0-9b6e-b8ea45e0db2e", "sighting--11fe143a-6a7d-4e6e-8e90-fbdfd84f4394", "sighting--f75c52eb-a81d-47a2-aa4c-b9f3e026d71e", "sighting--73f74c83-91c2-40cc-ab94-3c9d201d970e", "sighting--c390dad5-f2ed-4945-8ba4-9b07645d1a56", "sighting--087432cc-83ed-4b9c-9daa-488660d37b8d", "sighting--adff356a-4c72-401b-834b-8cc27b78ef40", "sighting--797203f7-5d4d-4cd9-9a03-ed5c7d1cc52e", "sighting--1b9399c2-5e2b-477b-9213-2f59f52457a7", "sighting--3f50f0f6-15b4-4ac3-93a1-be3e2e8b16b9", "sighting--a5abe5bf-01d6-4fb0-852b-1985de8255d0", "sighting--d1cb81ec-b4d1-4908-8035-dc6c2959975b", "sighting--395e941b-7b19-4006-8a92-face1919e97a", "sighting--f0392473-5227-4905-955b-5ea94f750974", "sighting--a5ccc4b3-731b-4408-aed4-b917421fe7f2", "sighting--760a72f1-ce76-40d3-8878-144c38f923ed", "sighting--98ad3ce2-b276-43b1-b7ee-78ce7c8b6c53", "sighting--c9957640-1fc0-40e0-ae8d-0bf02abba08e", "sighting--c2a09504-168d-4780-826f-69a1cd83f196", "sighting--ea471500-503d-4752-bc0e-fed2e76db05f", "sighting--18b0b31b-9723-45eb-839f-69bb55f47b10", "sighting--59a315d8-592a-484a-be99-46fc75937e84", "sighting--9d55b812-df98-4534-8506-ffbe64442a09", "sighting--26974671-17c4-4cb4-907a-37c1e211ca8a", "sighting--28770a88-9c8d-413f-b9da-1a4784d79fab", "sighting--4192e86d-4f27-4780-b8ee-29327cb5bb2b", "sighting--5bb8bb0a-40c5-4013-aa95-bb2735ecb26c", "sighting--bf72b3ca-5e8d-4a33-ac5e-51e94024f829", "sighting--4f69475d-fce1-4ff8-b149-d2ef4cf2e871", "sighting--95a2e6bf-2b5c-4240-b572-795a3697bcba", "sighting--4dd2097b-b8ac-4ed3-afdd-c5b88a17de91", "sighting--f3a15473-0f04-4682-bfc0-f27a15353f70", "sighting--49cce288-23ae-4aa8-87c2-18019cc6db24", "sighting--e084481e-4ff8-48db-a84b-37cd80e9b5e8", "sighting--d7a8990d-e94f-47c8-9256-e6bdaf24ab03", "sighting--4861665a-0ac2-4d6a-8710-a571e63a3470", "sighting--b7b54258-c43c-4ebb-8825-27842221ad9c", "sighting--c7352c50-67ad-4089-90da-0a832275e81e", "sighting--8e5c5d5b-e4c9-489b-a402-3a8da93dbf21", "sighting--044a0c5a-5fb9-4a89-a2e8-fba1578d8dac", "sighting--f7bd9976-47a4-4c88-b7e3-b77294f28a5e", "sighting--ee82dc03-9d5d-4f5b-98a5-c98ada66f73f", "sighting--6ee0708a-8633-4729-a65a-335c1d53d10c", "sighting--0f3ab62a-409b-4d0e-8269-f73debcb23df", "sighting--abc11995-bfe0-4d78-8b93-e60737ccd03e", "sighting--d7807598-2e31-47fb-b659-ad5e94c0f40a", "sighting--55875f41-1688-4d3e-898e-fa13d646050c", "sighting--8496897a-4868-47b7-8508-47bb99da5ae2", "sighting--2993e57c-f800-4606-97f9-adaa2207e719", "sighting--af02be46-5a74-4b31-bcee-38658f1db587", "sighting--e2b27102-2859-4fb4-9a39-c6e5bc4d9612", "sighting--27063396-7f41-48c1-b505-6dc931e492e5", "sighting--14d11496-425f-459e-a02c-68e7fca4d806", "sighting--d1d14cb0-2afc-484f-99c8-9ec789c286ba", "sighting--d3a28048-f00b-437a-9e33-4fbe6a037c3a", "sighting--d5c17770-34c3-4ed7-9c02-ef9023ca2c8f", "sighting--68302f5b-f0f2-448a-a320-b273afb5c473", "sighting--fa1acb7d-a235-4c74-bad6-eabff320cc51", "sighting--30e42a89-63e7-469e-a300-065cc398b5d1", "sighting--7efc0f0a-e54d-45c3-99ab-2123a234c46a", "sighting--18d929a5-10c3-467a-b75e-b77ceef43659", "sighting--a585784b-2280-4cdb-bc2d-765984099ec8", "sighting--f91fe60b-3436-4037-8a62-f0a1341e7dfd", "sighting--d4b6718a-10cf-430c-987f-8ba8abec7e35", "sighting--8223fc97-c203-4d46-b38d-bd2bc38d9b67", "sighting--bfd63c97-d4ce-40bf-8370-3fb6a6a4f56b", "sighting--1e71db02-78d9-4028-9e3b-7c6baa4cf53f", "sighting--0b709a15-c3c3-4499-844b-03238f3e862e", "sighting--eaa7495d-9f3e-41f1-9ab9-6b9dd172573d", "sighting--0adf9a9e-dcd6-4a12-8a63-1e91a98251c2", "sighting--cd036c97-7850-4e52-8af5-1ed5008510b0", "sighting--ec308cc8-34f6-45cc-aa08-6fad7a709211", "sighting--099af353-e384-40dc-8444-7098a782ec06", "sighting--70e689ae-aaad-4e34-95be-ae78f54ed707", "sighting--3bc37af1-9b59-4408-a3d2-a264e2f4313b", "sighting--b425ff60-7603-4857-9816-d68a827e5cb4", "sighting--cb8bb69a-e4bf-4385-add4-adb252699203", "sighting--03e98c69-74dd-4de3-80b3-67ca49ac534d", "sighting--f748df4e-03f9-4cdb-bde9-192b2ad7dbed", "sighting--3115d05c-63da-40be-9ac5-d9c4087df2e3", "sighting--fe24cfcb-16b6-46b5-bb38-a91bcd1e71b1", "sighting--697156fa-de6b-45b3-9d67-6c589f402f54", "sighting--993546f3-95f5-4836-8095-8ee6da6e411c", "sighting--18aaa515-de77-4882-8929-2852591e57e0", "sighting--07b50420-f872-4667-a5c3-ffcced322d39", "sighting--dac46870-68a0-4727-867e-57f30ea28335", "sighting--4c2cce19-41e4-4b69-b35a-a439bb74c2c1", "sighting--2ed95ddd-1fab-4606-a7cd-caf32462d45b", "sighting--4066f3b9-51fb-479d-a4f1-b149f20c6255", "sighting--9901de58-a367-4a60-bf00-c537047e0654", "sighting--404443bf-29ab-441e-9c86-f61ee66e21f0", "sighting--c4e3d425-6cb1-4025-b034-3f90f8fcc942", "sighting--81f919c0-5699-4c4f-b475-2b7a35ee7547", "sighting--24824b54-d32b-4ff9-a8b6-4dc6b2c8023c", "sighting--bf156b76-933e-4b31-b849-7f2c74aa3349", "sighting--e0f7143e-5773-44fa-9789-4488a8c9d2b9", "sighting--3dca5653-f075-427e-99c8-50a390122f68", "sighting--59673c7a-7221-45f5-9a6c-3d70659bdcae", "sighting--d74b2409-255e-40e6-875f-c7b178495fac", "sighting--f6f9c4b2-fdbc-4b60-b0c1-644909d515fe", "sighting--d728524e-6dae-4381-bf3a-d153bc925871", "sighting--0f9ca8c2-afb0-4398-9768-452eafee10ef", "sighting--7cfafb28-24d3-4359-bd29-51593b04c69c", "sighting--bed22667-3b72-4852-9e21-930c82885352", "sighting--970003cf-7fd1-439d-badd-7f8ff68dedd4", "sighting--7cbd8978-56b1-4a11-b4fe-b1738a5d1408", "sighting--2562aa68-8cb0-44ca-b8e4-4912e93aec34", "sighting--84714fa4-c958-4f70-ac77-a4fc9f23f6e7", "sighting--3ff067e8-0350-465e-a370-d6739f152fcf", "sighting--5e9a926d-d043-42b5-9c5a-2a9b935efb7d", "sighting--75b6da84-9145-4832-8034-b58c72d1931e", "sighting--b25330a1-2f65-4621-8a29-930a0c9d11eb", "sighting--529834c2-650d-427b-a7ca-00e3c60fd5b4", "sighting--40cd9330-5006-4ead-91d1-2e94e99f36ef", "sighting--027a8768-c7dc-4a7d-b765-fc9128d2c698", "sighting--d6bba4d7-65b7-4348-8f18-7f487faf3ed4", "sighting--25963bd9-697e-4b59-b218-b21d641836cf", "sighting--b77746ed-a400-43d0-ae2e-98d5061abb92", "sighting--47fe3fb2-e0e1-4c79-a556-9099174d9b0b", "sighting--91dd1612-8f96-46b2-aa16-e688907a7462", "sighting--dacadf6e-515c-429c-a867-32c5d4942d54", "sighting--7a53a5c4-470f-4e25-a37c-e328dca85047", "sighting--24b8929e-20be-4952-8f08-0e2bdd4fd49d", "sighting--17b128aa-1c1e-4f7d-9632-824c0e6c42fd", "sighting--f59fc995-5dfc-442c-a463-e790e2caabbd", "sighting--0bc08e07-1bb3-4717-9e9b-ab5a9017f67e", "sighting--8edbd3df-35d3-4292-bfb8-c91c8d7b8389", "sighting--bfb02765-f521-4c9d-b3bc-e3f18745093b", "sighting--42f1d4bc-c497-4b0a-b509-366e70ab2b8f", "sighting--bfa00f9f-d128-476d-869a-d6270b40bc69", "sighting--b7789a83-eec4-42ca-88a2-1d4574641b27", "sighting--e48f0ccf-e507-4d54-a2c7-47df380c73a9", "sighting--e64ed138-db01-4a34-9e1b-99b5423cea8e", "sighting--5cc31d19-54bf-49f8-88e9-062705f17d99", "sighting--018efceb-4553-40ae-a478-ffc271eed017", "sighting--4125fcc2-94f3-44de-a196-243f747b5a75", "sighting--834581b8-3bbf-4b03-83c2-5a8a007f9571", "sighting--55c58259-063d-4bc1-a90f-18af42094290", "sighting--66c510cb-5153-400d-8714-4e49d0fc5c0d", "sighting--cb5301bd-3106-4220-9253-9945c4c70fad", "sighting--d8c9ac8d-4dc6-425d-bfd0-3d55d0701219", "sighting--98f9635b-5fdc-4f04-803f-60beb4954217", "sighting--6d8d0665-0eff-41a3-b2ca-014f6e599e6b", "sighting--85b6a153-d93f-4406-8ee7-58d1acbe9b08", "sighting--2cb89e6a-8947-455c-9759-4d84f6be17b2", "sighting--9a0bd2c1-609f-4e60-aff1-91549ceace45", "sighting--d9567402-adf6-4c88-8891-842573146df2", "sighting--b94c5444-4866-47db-ad04-ac4e38142ab3", "sighting--bc637e41-1461-4bd3-97a3-cbb77edbd495", "sighting--8fa67970-51f8-4402-9d6b-fdcb68ac1af4", "sighting--14ef91d1-c254-4cbc-8d84-d974a0217b0f", "sighting--f3b0648a-9ba2-4668-bc79-ed245959d34c", "sighting--ca588e09-6c6d-461f-857d-31648e0f1335", "sighting--f778628d-b051-4d1e-aa04-e268ce49d946", "sighting--8816fd22-0bd4-468f-b40c-07ff2506c138", "sighting--458ca600-8da0-4887-924d-96d15f03a6ff", "sighting--5d03e129-ec08-42cb-8ec4-e1aae3cbfea9", "sighting--60b4af09-e7ed-4bc0-aed0-123f82c72a5e", "sighting--eef43363-befe-412b-b29a-96d90fcdecc8", "sighting--ef23e3ea-4e34-47b4-bf38-1ec9c34f1e8f", "sighting--faf7cd32-f7a6-4899-8f3e-88cae9e60c53", "sighting--69c87b10-bc29-41ec-8782-d0390832ae42", "sighting--6a3608f0-d8a6-4974-a398-23cc3b480c26", "sighting--119dbe5b-e351-477a-9425-2d7a83b03b0c", "sighting--fd48fe0d-6b1c-4cd9-a20b-d74464e8e3a5", "sighting--2255035a-11d2-4ea9-a539-0cbee0cefd00", "sighting--d9c6f703-b4de-442a-8b54-8ede982af992", "sighting--c6643d6a-cdb2-4f5d-aa48-659899e2384e", "sighting--1804db94-d040-4408-8967-9e94cf29f468", "sighting--b60b50de-8533-4840-8bc6-4437f47af392", "sighting--6d07e04b-4466-430e-8a10-43e8499c6efb", "sighting--dfd01193-0321-40b4-8920-a83b9bd8f65e", "sighting--e7ce2df4-8b2f-470a-8c28-be02bddace25", "sighting--9d365288-ee18-4b61-9cbf-030d042f5b99", "sighting--657fba28-54ab-4b7f-815d-8c14f767cc08", "sighting--03b8c188-4720-4563-8f7f-f48b9be090d5", "sighting--b388a6c9-cb8d-47fa-948f-1aae63c7414a", "sighting--aa20463e-9adb-4eb8-b977-90d1cd1c4fba", "sighting--aac4723d-2d8a-4510-8ff2-8fc2514793c4", "sighting--59f3173d-8ac3-46fb-8466-7ba2fa9af6c1", "sighting--9288e037-92e3-4656-a404-062d28174229", "sighting--93c57f5b-4c07-429f-ac3c-db856ec2074f", "sighting--d9e9b43c-ed55-482e-9f7b-072c53302e6a", "sighting--61453c1a-c7f5-407a-9133-5193fff07857", "sighting--cddc1bdc-99b1-4e3d-8444-8b5f322e33e2", "sighting--8809fda2-a305-471c-83a4-f998554ae114", "sighting--cc20bad4-0e02-4a36-b7bb-a66bc21c2b1b", "sighting--700959d8-2d54-473f-946e-b1d3d8432917", "sighting--719cedf9-52b3-4df2-bf19-1beae8830d29", "sighting--3772db8e-85d3-426b-ac10-a0253be3837c", "sighting--41dec130-6d6e-4c00-84d8-6aa62b254bf6", "sighting--c9c52cb9-2616-4668-9931-dce73ec660b6", "sighting--fba7426d-d0ec-493c-8894-ec1dc7bb056c", "sighting--9d493925-9be0-4a33-8a05-dca2f4ee9c7f", "sighting--e78d93d4-4ef4-44d6-9ee9-da7afd52641e", "sighting--a641b5ee-a63c-411a-ba2d-310d46904cf5", "sighting--59fad8fd-b352-401f-bc18-427b98333c70", "sighting--1dfe694f-4f9c-449e-b91a-1a6d9c243a81", "sighting--43d693da-9859-443a-ad89-8ff23950cbbf", "sighting--81871a69-84b5-4537-ad71-aacbcd39d79e", "sighting--4c2b9786-9b23-495b-a4cf-65c1b6a409ab", "sighting--618fe71c-6f0a-4f50-a883-fcdea3d977ea", "sighting--ff06fd02-4411-4fcc-8508-1af6b9afe2af", "sighting--624064e6-d562-453f-8075-acb5c44376c5", "sighting--e918f27e-2d6a-4b7d-874f-3b8a4636a3db", "sighting--a35b67d4-043f-44f3-83ec-7b9e2d29e1f8", "sighting--dbf08d7b-1c41-499f-9e26-7f91d4c1162b", "sighting--5e30ac09-f3cc-42c0-9b53-7d2f55fc0e45", "sighting--de5f9e8b-998d-4a3f-8f58-898ca94c6d3e", "sighting--800738dc-4de9-4e51-bf54-22401282fde6", "sighting--d11b3727-12bb-46cd-ad90-a36eac05ecd6", "sighting--3df5d2c6-d242-4d76-939f-ecb1ce9cde10", "sighting--84c231f7-3ed5-4602-95a1-b7516182ab2b", "sighting--17c559d3-daff-45bf-adce-69d238ea0e6b", "sighting--1778db1a-b85f-42aa-bd2e-85a02d53c792", "sighting--19d74da1-c40c-4790-87d6-b16a4e6df78c", "sighting--94807b82-019b-4b0a-82bb-3080df2dcfb2", "sighting--9f0c67ad-aceb-4b1b-9062-f7ea07e3bc5e", "sighting--9a0e0d6f-189d-47ee-852c-6434145a8f17", "sighting--db79092d-961a-4458-b3f9-bc93816312ec", "sighting--6749a247-c0e0-41a2-9996-c9244482f42e", "sighting--f6290ced-924f-4524-b126-6ded409acc59", "sighting--8d90fd29-afaa-4b71-9c8f-18c666fb7377", "sighting--8b355d91-d486-46bd-bdd0-e6b3221997ec", "sighting--8d770b99-5adf-4d8c-b85a-03df52e90fe8", "sighting--06162a45-e6e8-435f-ab5f-0ef0e400ae50", "sighting--867afee0-c03c-4412-ab53-785126965aa7", "sighting--2faa6d45-3910-47a0-a7b5-1cd7146cb17c", "sighting--952e76d4-ab09-4f2f-a322-334da510c8a7", "sighting--b6744bf0-5595-4e6a-a757-d1607d570e86", "sighting--4c7d4076-ecfd-457b-a13c-7d8e6ab693bf", "sighting--a205111d-fd1d-4803-aaa7-e5019edc3468", "sighting--a95de01d-a6e0-4026-9094-de9160b9ecaf", "sighting--d8b78876-4049-404c-b0e6-083926c2e720", "sighting--66afe80a-4d28-4a2c-ab81-cc9c001e54e6", "sighting--7431d013-4f6b-4496-9a3a-8c862baf2098", "sighting--b24045dc-c988-4efc-977e-f8ea87c3b68d", "sighting--bcb1dbeb-44ec-4f19-a3b8-ef5c1da7b2e3", "sighting--2ecd6332-91f5-4767-bf8f-b1f200f3884a", "sighting--e96cedbd-4119-478e-acc9-72e8371cb916", "sighting--3e9bc2f6-7f30-4ffe-851b-9103a0e23750", "sighting--33b02d13-2b1c-464c-a3aa-f5e1bc6f3a19", "sighting--a12098ac-1988-43e8-a13f-e4327f7e8478", "sighting--e1614963-a0f5-4b30-985d-412798c01ec5", "sighting--35cb8df1-c8bd-4914-b20a-61c5b5148ad6", "sighting--bd711c3a-1cca-4de6-bd7d-31207a10e410", "sighting--b3ced5a8-ce14-4794-9393-499acfcf5b76", "sighting--7f2ac8b3-6609-43a4-9668-69ff93f75fee", "sighting--31cfa62e-d780-4228-bb83-1617b37714fe", "sighting--271b7f38-6369-419a-81b2-37ea164bb319", "sighting--1072ed77-f1aa-4920-b793-2ab2bc5ebd2b", "sighting--4d51c9c6-e10c-483e-a6f8-0c49a6c6ebfe", "sighting--f4b44b25-7544-4575-8570-5349a4e68d91", "sighting--b7654818-0428-432d-aed8-7b14f9a3c7e2", "sighting--feca446e-57f9-45dc-91b5-bae36a2bb4fe", "sighting--01672eeb-7dbc-48c3-92d2-52708c9d923b", "sighting--7c8ee4a2-b8a4-46ee-9528-ea3ad2d58b4a", "sighting--a83a0529-10ea-4353-a303-e9640e338738", "sighting--40093765-7b1d-4cde-8f27-d066b7306a54", "sighting--fa265a80-ed11-4679-b3ef-430e4dde208b", "sighting--42e61666-e4aa-4c3f-af06-ce3c36827bc7", "sighting--8d39a53b-3f90-479a-b818-0178579cfa2d", "sighting--b60e1ff4-3e1f-4784-b1aa-5c809f26394e", "sighting--c2368ef1-47eb-4ee4-ab7a-ac8c709e899d", "sighting--26760340-3bd5-4f7f-a963-520ab773c08c", "sighting--6cd56a5e-95b0-4f62-b0f6-4b0cfb35123d", "sighting--0b89baa6-54ac-4b73-be08-6b243ed10caa", "sighting--dc1b636a-28d8-4ce7-8582-a9dddb8ae26d", "sighting--98b60427-c6ab-48e3-85e2-039e83ace1d1", "sighting--14bb4041-42ab-4f53-840b-6854ca33104a", "sighting--e6987fe7-5fe0-45ae-b70f-65e4763edb60", "sighting--a63dc445-b84c-47fd-8cdf-9e806a020dc4", "sighting--d2f8f79a-e3f8-43ea-8d9c-72fac3c8d0db", "sighting--e1cb0a6d-f39e-43cc-86c2-48cfb750e262", "sighting--dd384668-ac82-4024-8121-9eb49deb6a8c", "sighting--f263afca-d29c-46b8-8fda-92cc4c050c12", "sighting--d7c24325-6831-4c58-b941-edd804c9f4a3", "sighting--918b923f-794e-4983-bf29-1bed8f29da04", "sighting--1db509b0-940d-4f10-82f5-6c34a9c80f2d", "sighting--cf830150-5b4d-4b40-b54f-495fa32b2176", "sighting--b373f5ca-8ae7-4895-9d3c-e9d442b28041", "sighting--ca2fad91-0491-41b6-9fba-69b31d552eae", "sighting--59c7eb98-2437-4851-8998-62f775bf0c32", "sighting--de2acaf9-25a4-4a34-80bf-013d1bd8ce07", "sighting--fc88c874-e7b7-4469-96e2-9f5bd92aee0f", "sighting--2ad0db52-c019-45a8-968b-06b01cb3b956", "sighting--e208d4a4-8525-47bb-8035-e6f12995a29d", "sighting--8f2aee2d-ae37-4054-aa7f-c15d4805554d", "sighting--71501c9c-f85f-4986-892b-b15072b04fc6", "sighting--3757f159-a844-4482-9e16-c3b2371842a5", "sighting--6e835cac-89ea-4e74-b69f-69e3d98b04f0", "sighting--9f15c227-452c-4e08-9ac7-592899d73e9b", "sighting--4454a412-1200-4712-8513-5fcd15cbe2fc", "sighting--d0b0844a-d556-4d4b-ae0e-aff418822aa6", "sighting--6d701794-742e-43c8-ab96-7d157d988aa7", "sighting--db6c228f-935c-400d-94df-8951b8eaa970", "sighting--5386f0bd-14f2-4958-bfc6-47a7c564172a", "sighting--298ecbba-b9b0-42c0-b8ab-a43a29592398", "sighting--d191885c-d967-4c6d-9b9d-a2663e434fb5", "sighting--2620de22-d8ef-4b92-90ca-d5cc455cddbd", "sighting--f52c9fe0-14ec-4835-b449-e01a2db2ecf3", "sighting--2943156f-09e7-4312-a4de-1be2104d1610", "sighting--aaed64f2-fa37-4acd-b333-86ee4b57cde9", "sighting--c8f6f013-ca69-476a-92c3-e24d1e389b50", "sighting--88aebf41-a680-4c8d-b645-9c9ddc6d9ce8", "sighting--c43d8ec0-9a28-4c60-8be1-bff71430c8c4", "sighting--b35457d6-96b8-4c6b-8e22-36dda76281bf", "sighting--7710fb9e-f5c2-4a1b-adad-cc271fce6397", "sighting--53688390-ce65-4cbc-b91f-54f04b95c69f", "sighting--50736f28-30f6-4109-bae2-ba2317e80132", "sighting--6e623f8a-73f5-4741-a6a3-bd0cb6cfdca8", "sighting--9f7b63e0-fff9-4168-9820-1deda136d748", "sighting--dc942cbf-a9cb-4a7e-9ae6-4b4fc6e713a8", "sighting--d420c3c3-778f-41b8-9f6d-46310096602e", "sighting--25bd3e1b-c0fd-41b7-b327-436da714d2ad", "sighting--226cb686-b49c-428e-952e-9f812d933b8e", "sighting--d84c8cf4-6bf5-4db8-97ee-ca5bad031ecf", "sighting--8ce848ac-ca69-4aac-90ec-6e0b81a8cef9", "sighting--504e8fab-cf36-4d72-839a-49b8cf543d5e", "sighting--cc063065-f565-4136-8e92-4cbf39db0a7a", "sighting--2006afa6-b41a-4460-99d8-d73fd8992b4c", "sighting--d2d7a267-fb81-4411-8df7-f0bd67c473d1", "sighting--69224cc1-16d5-4c05-8e7b-730b097f3bde", "sighting--28a9752a-b260-47bf-8f67-5e89b0493886", "sighting--9295e80f-0809-4bac-902b-080b9148adf4", "sighting--595134b1-5503-4586-b402-50ff3ffc29a7", "sighting--1d97c7ae-3846-4250-9e90-2fb406fb8cc4", "sighting--06eba541-285a-45c1-9a52-317cab1811ff", "sighting--1f6b07c0-5fbd-4c7c-8418-0ba182dbdc31", "sighting--003a0d05-85da-4f06-bd1b-9aa69d0b6bab", "sighting--01bee517-8c67-47be-b28e-bb50153c3910", "sighting--900ff701-3899-4914-9393-e1ecd235b7b5", "sighting--b5fee7b8-e26f-4bc0-8fcf-8ea9d1a11cdb", "sighting--146b43fd-9ee1-4883-b40a-01ea7fa30db9", "sighting--57ec1ef4-a2c9-4162-be70-da051be70e45", "sighting--a7bb6ffe-1bb9-4ada-a25a-a1c8cb90c72f", "sighting--45f64ca2-5168-4a00-b0c7-69434e377910", "sighting--3f17b6b5-54be-48c8-8389-1e30c6f5aa9d", "sighting--583da71a-06ba-45db-9c2a-3bd014f42182", "sighting--aac5b785-c481-4acd-bb9e-232765cde35d", "sighting--d8236d1a-699e-4777-9663-53e251ae9f26", "sighting--e92eaf49-3815-4cad-a433-a3b1911afecd", "sighting--8f743cca-094e-4d87-a7d4-4aac1948bf1a", "sighting--7c8f9d14-1578-4772-96f5-30b04948d132", "sighting--e4872643-3e6e-4a02-bc03-4e8e50922023", "sighting--3da40b17-4a24-40fe-8380-d8312e0b47be", "sighting--a48f955c-8453-4e0d-8667-a422ada6da77", "sighting--92cdc19a-d2f2-4080-b5ee-a757827019c2", "sighting--adbdcfdc-2f16-409e-928e-a7de75aac2c3", "sighting--536ee486-68c5-4cdd-aceb-19b4ddff5347", "sighting--1e9c1a87-4295-4344-adf1-8732e57dad32", "sighting--c5c2f108-be1b-4d2b-8b1c-013cf54e2f93", "sighting--b57d11e1-d0e1-4c96-ad21-32221e653578", "sighting--e9e6b84e-6053-4f2a-a9f5-df7247b8e3cf", "sighting--e19b7894-3d43-4770-8bff-23fa376fc1bd", "sighting--e73d74f3-bdb4-4a2d-afc6-95e2c384c2cf", "sighting--b0a0f69d-f250-421c-bc98-ee2f60468d4f", "sighting--a226db12-8119-4600-85a4-a64969b8b010", "sighting--76c3d4ac-6de7-44f6-8552-cd1ad3e89ab7", "sighting--63758b9f-9bf8-4258-8ae3-91473ce88726", "sighting--2074cb9e-5609-45e5-a6de-2a02bc55751f", "sighting--8b4b154a-8cbf-44c0-b40d-9b653545e49e", "sighting--0ce9708f-7220-47ab-9c7a-17f6b42cc2b8", "sighting--fa78e62c-4166-4253-b0b0-521d297eeac9", "sighting--50c62541-4d95-4d5f-98dc-1d906edd3cc9", "sighting--3e7ff2bc-d8a0-4818-a59b-9b0aab56becd", "sighting--c6ce3e7f-7736-4105-8d76-b58ce78ee576", "sighting--2458d671-e4c1-42dc-b418-3c326e9bfec1", "sighting--7c7c7a1a-c3ee-437d-ad7c-bfb736293d29", "sighting--90ec8005-7c10-4e1f-8eed-a87e93fc65b3", "sighting--c2d0ec8e-971e-4d65-a939-b3013c321725", "sighting--ae79497a-87aa-4607-9b9c-c79f4221f99c", "sighting--b8f684b7-3746-448c-9ca2-231344dc23ea", "sighting--8c1f089b-b223-4184-8d94-b68ac6a8e1c6", "sighting--c40a867d-d13f-47fc-8141-1c7f3a307a6a", "sighting--95bcff3c-21ac-4968-9cc9-b12b81cd97d0", "sighting--7814af45-c5fd-498b-b070-b6d9557d600d", "sighting--aea7505e-6019-4651-a375-22df4ce2d114", "sighting--c8524351-c739-44f8-bc77-075c9ffb2884", "sighting--7cbdd004-f211-4ff9-b373-cd7260f09a02", "sighting--4c593fe6-087c-4579-9d2f-314d4c489e8c", "sighting--02de401c-4bc8-4079-b418-a77f3c93fde9", "sighting--1e8f7c93-75b5-493b-9042-278e7d5626e9", "sighting--6956af90-d2e6-42d0-a65c-89863c442d04", "sighting--954913aa-29c9-4e94-8ff6-12a9944f348c", "sighting--55ba47c0-1d51-454f-8cea-b70f969bc86c", "sighting--0bb455e4-fb77-44b5-b467-9a521f72a067", "sighting--0401d4b9-0ee8-4bab-8a51-95425a366d4c", "sighting--83f2211e-ef3d-4ca9-a0c6-8d0c5d6e4508", "sighting--3bd5852a-4379-4902-8758-e2649818126b", "sighting--aa20ba60-d6ce-403b-b10d-b95cec8ad19c", "sighting--1a2b1cf7-3c2e-47c8-812e-7e57f7602d04", "sighting--4aa0bc20-9c0d-4a4c-a893-9392d8796cfa", "sighting--2eed76d9-5495-4eeb-8565-7ec21d15ffaa", "sighting--fb3a9a5b-e07d-4ae2-832f-d68c749af8dd", "sighting--649360a2-d86f-41a6-9115-1c6346c1e833", "sighting--23815342-5ee7-45c2-8e16-b2ba87dd1e97", "sighting--e9397567-40a7-4bc5-9550-e00418521067", "sighting--4f46a84e-39a0-44d2-9911-7fad851c5350", "sighting--172bdbd3-8010-44be-9494-0683a9753997", "sighting--7e29f0bf-46e2-48d1-84e1-1dee580116ea", "sighting--ea42bc16-cfaf-4640-af3c-b0cbe2265b54", "sighting--83876713-3ccf-43bb-9fa7-654c21b582ce", "sighting--c6836ae7-0ab0-4401-afe8-95729ea60894", "sighting--1fc5f60f-5a10-4755-b14a-666f097c7c51", "sighting--c6f3ce88-c52c-4b23-bf51-0e4cb0edae82", "sighting--29be6e11-1caa-4805-8867-3e3b9ac9fd73", "sighting--8df4ee31-67a3-479e-9cbd-f8e3ead88978", "sighting--8321b70d-b63b-4aef-9fca-059332c8cc2c", "sighting--f5d35eb7-cc0e-4fb8-b506-e3663b4fea39", "sighting--78899800-d7de-471d-a712-990f3195b1a0", "sighting--a201173f-4d80-4df9-87dc-bbdfe6cdda4e", "sighting--9f422383-a32c-4715-b48f-34117f580c69", "sighting--1bfcada0-0b53-49ca-8fa2-a244c87ac3b2", "sighting--fd0071fd-fde3-41af-9247-fba5ef4b0d4e", "sighting--537dfd2f-f1ec-460b-8875-eb095af4c968", "sighting--5cd4c400-8078-490a-ad4a-0cb43ab46e0a", "sighting--a47e16b2-00ae-46b6-885e-3b46cd6fecf2", "sighting--d064cc88-3bbd-4d63-bde0-77feb5645cb9", "sighting--e95a71bf-ec8a-4d5d-a37b-71b5ae42e416", "sighting--477818e6-2b31-4124-8d28-9771447e76cc", "sighting--112cb008-5215-4175-897e-9c21ec0b5546", "sighting--ae1d0543-f011-415a-ad1e-65275f6d4a7c", "sighting--ccc819fc-3c55-4346-8cf4-dfd835341dd1", "sighting--e89ce902-a3f3-48f8-8fd0-9e52865c3059", "sighting--b76f6769-8af7-4376-83c8-e6d2f4dfb5f0", "sighting--5aab53a6-766d-4f88-acee-2224020f4122", "sighting--da59c197-20a4-4079-9be1-94b35f8aea7f", "sighting--158473cd-0e98-4f5a-9228-ede87c734105", "sighting--58d4deec-7d30-4c47-925d-adcf23059f03", "sighting--4bc798ea-eeaf-41f4-8aeb-e8ad9c81f9a8", "sighting--c9d35eef-9f87-4f07-9e77-e74b52116a36", "sighting--938e14ca-b59b-4ae8-b027-d8044bd3fef6", "sighting--a024c4f2-b951-44e4-a9bd-d9791ed86a16", "sighting--a6f0094a-2725-48d2-a237-b34fb28fb736", "sighting--a0972a5d-cca3-4596-97cd-4e992c1af6ea", "sighting--3dc8d25e-d7ee-40aa-9a38-5b459a07f887"], "created_by_ref": "identity--8f46cf6a-622e-4127-bbdd-968d59ea87e0", "created": "2026-10-14T11:00:01.614Z", "modified": "2026-10-14T11:00:01.614Z", "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]}, {"type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": {"tlp": "white"}}]}