{
  "Event": {
    "analysis": "1",
    "date": "2026-04-07",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-07",
    "publish_timestamp": "1775581255",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1775581255",
    "uuid": "0833fc76-616b-4182-9069-ca67c5b62de6",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T02:19:30.805606+00:00",
        "timestamp": "1775528372",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5471c9e0-92cb-4f1b-b898-6ee64f475ed9",
        "value": "2a02:c207:2315:7388::1",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T05:45:46.096834+00:00",
        "timestamp": "1775540748",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4a23d90f-32e7-4cf9-8e24-7f5eb5ab379c",
        "value": "110.93.150.31",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T05:45:55.414289+00:00",
        "timestamp": "1775540757",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "536d8b9e-da8c-46c2-b75b-3cc99287c7ee",
        "value": "211.249.46.66",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T06:03:34.050120+00:00",
        "timestamp": "1775541815",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "24f26288-dcdf-4470-989b-717f07422763",
        "value": "34.6.109.61",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T11:46:23.513567+00:00",
        "timestamp": "1775562384",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5b62f068-4fc5-4a9b-84cb-4c6aa03dfed1",
        "value": "211.249.46.42",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T13:10:12.041687+00:00",
        "timestamp": "1775567413",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f4ba3fcb-caef-4d10-9369-275504ee525b",
        "value": "103.8.27.27",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 123.58.200.147 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T13:34:25.112623+00:00",
        "timestamp": "1775568866",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "53298254-e726-4045-9f38-8af7eed4619d",
        "value": "123.58.200.147",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T15:40:59.288768+00:00",
        "timestamp": "1775576461",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0cad7a84-e3f0-4999-849b-b3051d67f34a",
        "value": "208.77.244.162",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-07T17:00:49.082664+00:00",
        "timestamp": "1775581255",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "84c8b5a9-db53-427f-9f46-4fe9b7ab3dbf",
        "value": "20.200.222.0",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}