{
  "Event": {
    "analysis": "1",
    "date": "2026-02-18",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-18",
    "publish_timestamp": "1771446170",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771446157",
    "uuid": "0090ebf7-461f-480e-96eb-c3715fa15b5f",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T01:29:19.645998+00:00",
        "timestamp": "1771378161",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8e98e5a0-5a35-4834-ab33-1672e3ce6829",
        "value": "2001:470:1:fb5:4db9:b7c7:f9ae:6e94",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET MALWARE SysJoker User-Agent Observed",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T03:04:26.831898+00:00",
        "timestamp": "1771383868",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "377efb71-5c10-4e51-87c4-e73fd9e82ce5",
        "value": "147.185.238.214",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious PHP Code in HTTP POST (Inbound)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T11:05:23.164978+00:00",
        "timestamp": "1771412724",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5fbe2260-1f6a-4876-ad70-2cb7a965b2cf",
        "value": "202.155.143.184",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T11:18:36.565276+00:00",
        "timestamp": "1771413518",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cf034cec-bc3f-4702-a8b8-ee950269d887",
        "value": "143.110.218.196",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT HTTP Request to 127.0.0.1",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T11:35:06.596860+00:00",
        "timestamp": "1771414508",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "40a9130f-00d2-4cf2-bf76-af205f0706e3",
        "value": "::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T13:51:36.913475+00:00",
        "timestamp": "1771422698",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ee4982a0-f3a6-42d9-b6f0-90798647e7d3",
        "value": "46.254.11.112",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T14:15:46.990977+00:00",
        "timestamp": "1771424148",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "374355ac-92b7-4508-a114-1d5fdb4c6518",
        "value": "81.56.215.143",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T14:19:13.415206+00:00",
        "timestamp": "1771424355",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a8af3710-7a0b-49d0-a6f1-0982128e3816",
        "value": "13.228.212.140",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T14:19:21.516884+00:00",
        "timestamp": "1771424363",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0f3ede5b-bdb4-443d-926b-e8daed2b3b38",
        "value": "2406:da18:d5b:7a03:f51e:6ed1:9064:7e35",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T14:19:30.769704+00:00",
        "timestamp": "1771424372",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b2c61a12-a42f-4b16-8398-3c659e964155",
        "value": "103.103.22.220",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T14:23:03.003118+00:00",
        "timestamp": "1771424584",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f4db4071-35d6-499c-8542-6b057458cb30",
        "value": "207.244.237.141",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:05:29.919414+00:00",
        "timestamp": "1771430731",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "20e3448f-c206-4b92-858c-fd876c92e023",
        "value": "159.69.149.81",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:34:04.727489+00:00",
        "timestamp": "1771432446",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ecdb5c5d-165c-4054-807b-6600baa8b50f",
        "value": "209.126.4.40",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:35:02.097303+00:00",
        "timestamp": "1771432503",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e683fbce-af14-496e-9a6e-ecb2fa231851",
        "value": "195.178.110.108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:46:04.972486+00:00",
        "timestamp": "1771433166",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8bfdb606-5757-449c-9f35-fd9d75874a4a",
        "value": "15.204.243.85",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:47:15.902852+00:00",
        "timestamp": "1771433237",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "aef9299c-857c-40de-a716-3b721de01517",
        "value": "46.101.173.12",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T16:54:01.125335+00:00",
        "timestamp": "1771433642",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b2fa89f2-41a5-4f2a-8853-3eb5ea2b97ee",
        "value": "156.67.28.252",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T17:06:29.083925+00:00",
        "timestamp": "1771434390",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "864caabd-2b9f-4da2-8a80-f839fb95554c",
        "value": "89.23.102.12",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T19:26:15.371481+00:00",
        "timestamp": "1771442776",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ba74f2e7-f07d-48ad-ad6f-7e760b706850",
        "value": "51.75.169.100",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-18T20:22:36.069382+00:00",
        "timestamp": "1771446157",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "735404ca-1ac8-49d1-8c06-f974f26bd5f9",
        "value": "52.67.96.45",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}