{
  "Event": {
    "analysis": "1",
    "date": "2026-04-26",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-26",
    "publish_timestamp": "1777241988",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1777241988",
    "uuid": "1b6ec04b-4030-4a12-b1b3-b483874dff6b",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T01:03:27.602743+00:00",
        "timestamp": "1777165409",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ca436428-408d-4e22-9094-7046b0d21364",
        "value": "103.215.74.213",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T03:13:28.419635+00:00",
        "timestamp": "1777173210",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6a33f5b1-5ec0-4536-b379-f48282e0c9da",
        "value": "2001:470:2cc:1::29f",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T05:15:28.132446+00:00",
        "timestamp": "1777180529",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e42c3302-b77e-42c3-bad2-93dbd25a4ae9",
        "value": "64.62.156.108",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T11:17:00.857666+00:00",
        "timestamp": "1777202222",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f5430858-6015-43d0-8893-b79fd639e7f1",
        "value": "2a14:7c1:400:1c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T11:56:16.739605+00:00",
        "timestamp": "1777204578",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3c1f5ff4-c70e-4da9-aad1-780d52dbb0d0",
        "value": "2a14:7c1:400:1::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T12:22:15.291903+00:00",
        "timestamp": "1777206137",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "68a6c154-d8c4-49e3-8769-f7f4c310fe16",
        "value": "2a14:7c1:400:c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T12:22:19.759941+00:00",
        "timestamp": "1777206141",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "72d7a0e4-b441-46c5-b8fb-cb7cdc040731",
        "value": "2a14:7c1:400:27::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T15:38:05.107340+00:00",
        "timestamp": "1777217886",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4d2ef57f-01b5-442c-a84e-e57c667a51e5",
        "value": "125.209.235.172",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T15:38:13.605023+00:00",
        "timestamp": "1777217895",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "aee4a8df-c5d7-4e0e-8e81-38c6fc6550f9",
        "value": "110.93.150.112",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T15:39:18.204162+00:00",
        "timestamp": "1777217959",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "31d771d0-1b83-4de4-afd0-53f7f48dff19",
        "value": "110.93.150.204",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T16:15:38.888822+00:00",
        "timestamp": "1777220140",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dd1251b5-1b9b-4ffe-a0d3-2151a4cf8d13",
        "value": "20.163.78.59",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T16:53:18.625940+00:00",
        "timestamp": "1777222400",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8615ba05-e264-4cdf-9a9a-9144cf306aab",
        "value": "195.178.110.65",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T18:43:20.848880+00:00",
        "timestamp": "1777229002",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "345062a6-851e-483b-8ee9-1d7ad2ca2cc9",
        "value": "2a0b:8bc0:2:a335::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T18:52:47.158602+00:00",
        "timestamp": "1777229569",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "970a1101-07b1-48e5-b2c0-923f5d2985fb",
        "value": "57.129.2.29",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T21:56:16.849257+00:00",
        "timestamp": "1777240578",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5738d221-ba8d-475b-bfc9-b7cd731a1af1",
        "value": "43.155.162.41",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T21:59:42.301399+00:00",
        "timestamp": "1777240783",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e2644e0e-3784-43ba-be36-86cd76758bf3",
        "value": "49.51.166.228",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T22:01:38.988334+00:00",
        "timestamp": "1777240900",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9030b6a6-62a4-4892-a4d8-5c45f31fe83f",
        "value": "43.134.186.61",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T22:16:56.088753+00:00",
        "timestamp": "1777241817",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3b1f2027-b9c0-49e8-9364-9712fea63b4d",
        "value": "43.166.224.244",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-26T22:19:46.163548+00:00",
        "timestamp": "1777241988",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "de704839-7d5d-4328-bb33-d3512140d5e6",
        "value": "43.156.232.190",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}