{
  "Event": {
    "analysis": "1",
    "date": "2026-01-26",
    "extends_uuid": "",
    "info": "KRVTZ IDS alerts for 2026-01-26",
    "publish_timestamp": "1769433660",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769433659",
    "uuid": "2b322fc3-b9d7-4b2b-bb94-b16545e25c75",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#bf8e0e",
        "local": false,
        "name": "KRVTZ-NET:information-gathering=\"scanner\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T00:15:24.859565+00:00",
        "timestamp": "1769386526",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "836314ac-e603-4020-9909-74d6d2657816",
        "value": "2a00:23c7:8eab:5101:9892:31ad:56c8:e8f0",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T00:17:01.074805+00:00",
        "timestamp": "1769386622",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "57e79471-7fab-495b-8c1b-430d54af05c8",
        "value": "149.88.101.23",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS Suspicious User-Agent (InfoBot)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T00:34:45.766229+00:00",
        "timestamp": "1769387687",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "01318140-1505-40ee-807a-f40c86072ddb",
        "value": "34.74.248.16",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS Suspicious User-Agent (InfoBot)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T00:54:59.855288+00:00",
        "timestamp": "1769388901",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "81fdfd08-0b46-49cb-8fd6-2fac7663731c",
        "value": "35.229.83.27",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 2001:19f0:5:1674:5400:4ff:fec2:b3f7 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T03:01:53.339945+00:00",
        "timestamp": "1769396514",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "afa7c113-9a06-4552-b654-84cdc1025f91",
        "value": "2001:19f0:5:1674:5400:4ff:fec2:b3f7",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 2001:19f0:1000:67bf:5400:5ff:fe0e:9672 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T03:07:20.427058+00:00",
        "timestamp": "1769396842",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "56b07613-d69a-45ae-b76e-9490f7f638e2",
        "value": "2001:19f0:1000:67bf:5400:5ff:fe0e:9672",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T03:56:05.598162+00:00",
        "timestamp": "1769399767",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c590b877-aad5-49e5-b36d-5e90989ad524",
        "value": "92.44.24.40",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T04:07:54.566474+00:00",
        "timestamp": "1769400476",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8439768d-3830-4162-aaeb-d3065674713c",
        "value": "107.155.97.54",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS Suspicious User-Agent (InfoBot)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T06:26:24.500304+00:00",
        "timestamp": "1769408786",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4624e793-bb97-4c35-9b67-fa9be683a0a2",
        "value": "35.196.154.35",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS Suspicious User-Agent (InfoBot)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T07:02:15.997725+00:00",
        "timestamp": "1769410937",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d9f6c160-4fe5-48fd-b4bf-0f083db82843",
        "value": "35.229.36.101",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 149.28.234.82 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T10:59:36.876677+00:00",
        "timestamp": "1769425178",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a79e6f23-ff09-42c5-8a4c-eb35d4bd86ec",
        "value": "149.28.234.82",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T11:16:15.603156+00:00",
        "timestamp": "1769426177",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4a8b8eda-44f9-46ae-b2d8-c1e6e1b61009",
        "value": "80.232.162.226",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T12:31:54.871291+00:00",
        "timestamp": "1769430716",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a796b957-1de6-4be0-bda6-125e3451bdc3",
        "value": "20.70.170.217",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-26T13:20:57.792943+00:00",
        "timestamp": "1769433659",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ffdda6ae-ec25-4296-9943-2479ba9b69f6",
        "value": "91.243.188.233",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}