CTIXView source docs
Location
The Location SDO is related to an Identity or Intrusion Set to indicate that the identity or intrusion set is located in that location. It is also related to a malware or attack pattern to indicate that they target victims in that location. The Location object describes geographic areas, not governments, even in cases where that area might have a government. For example, a Location representing the United States describes the United States as a geographic area, not the federal government of the United States.