{
  "Event": {
    "analysis": "1",
    "date": "2026-04-25",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-25",
    "publish_timestamp": "1777157344",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1777157031",
    "uuid": "23defe04-475b-4888-9033-d3fcf9d262e0",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T00:40:44.515938+00:00",
        "timestamp": "1777077646",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c7cecfbe-9f3b-4b36-8302-b4fd493b2200",
        "value": "2a02:4780:5e:654c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T02:30:54.821778+00:00",
        "timestamp": "1777084257",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "75dff1d8-d993-4210-9103-80eb9c6d864b",
        "value": "2a02:4780:5e:2f1c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T05:05:35.624788+00:00",
        "timestamp": "1777093537",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3cd64057-1a72-4919-a4a6-7f2deff4b317",
        "value": "43.166.244.66",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T07:32:34.156187+00:00",
        "timestamp": "1777102356",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "639ae04d-e916-49de-a0cb-d9d94abc7f48",
        "value": "13.135.71.144",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER PHP tags in HTTP POST",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T08:15:26.980436+00:00",
        "timestamp": "1777104928",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "06987e2b-6a95-4f7e-b4ab-c6ed08041891",
        "value": "46.101.167.196",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GPL WEB_SERVER .htpasswd access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T11:15:33.666574+00:00",
        "timestamp": "1777115735",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dc636e41-f9b7-4cbd-ac77-9e5462de7e42",
        "value": "195.164.49.68",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T11:49:43.461187+00:00",
        "timestamp": "1777117785",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "93d0180f-fe71-4451-bb7a-cb44a9c00f96",
        "value": "88.151.33.240",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T12:00:11.706118+00:00",
        "timestamp": "1777118416",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4c0862db-0183-49c4-bfef-13c2e78e5c2d",
        "value": "88.151.33.234",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T17:49:38.794301+00:00",
        "timestamp": "1777139380",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "553f1b80-55f8-46d8-a365-d831dfb28a79",
        "value": "38.133.213.104",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T18:21:24.432661+00:00",
        "timestamp": "1777141286",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d81528fa-9594-4693-8945-0a6422133a55",
        "value": "191.101.11.159",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T18:21:28.385738+00:00",
        "timestamp": "1777141290",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6036567c-5009-418e-8254-56e84782a30c",
        "value": "166.88.155.176",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T18:29:29.843378+00:00",
        "timestamp": "1777141771",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a4c9e689-5583-4ddd-97d6-583e0f2628f3",
        "value": "43.166.224.244",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T18:49:15.387946+00:00",
        "timestamp": "1777142956",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9de4b98a-ef95-492e-972b-46ec0f705501",
        "value": "3.82.63.122",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T20:31:40.622312+00:00",
        "timestamp": "1777149102",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6728f8ad-c5bf-4fa5-9fe3-e61cd108c434",
        "value": "34.60.90.24",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-25T22:43:50.352243+00:00",
        "timestamp": "1777157031",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2f200c92-aedb-4d7a-9f7f-d08ed093bc87",
        "value": "206.1.31.15",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}