{
  "Event": {
    "analysis": "1",
    "date": "2026-05-13",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-05-13",
    "publish_timestamp": "1778708844",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1778708843",
    "uuid": "504dd707-68e4-4636-9c36-94ad505e666c",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-12T23:56:16.150260+00:00",
        "timestamp": "1778630178",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a737d802-719f-4044-af07-35af22336f9c",
        "value": "166.88.169.211",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T00:03:48.726742+00:00",
        "timestamp": "1778630630",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "53d8cf0e-22d7-4166-b885-00c184fe5c58",
        "value": "82.29.236.223",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T00:04:16.186020+00:00",
        "timestamp": "1778630657",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6ccac9c1-6a4b-4efa-a0c9-7816e284590a",
        "value": "204.217.161.116",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T00:04:24.992777+00:00",
        "timestamp": "1778630666",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5bedfb56-9493-417a-b42f-acd36b162465",
        "value": "82.23.225.94",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T00:07:51.769830+00:00",
        "timestamp": "1778630873",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "60aa8915-f05e-4b39-bcbd-5c7072cd2c7f",
        "value": "13.206.210.150",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T02:27:03.813950+00:00",
        "timestamp": "1778639226",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6b6e5c70-c2a4-40cc-9747-3da5d7fc6291",
        "value": "142.111.98.29",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T02:27:20.003764+00:00",
        "timestamp": "1778639242",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0a42e2a1-c49a-4994-a546-60f86e586cd2",
        "value": "67.227.36.235",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T02:49:44.247792+00:00",
        "timestamp": "1778640585",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dab5270a-aa63-40fd-800f-4214b3ab828b",
        "value": "107.175.135.81",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T06:46:10.234468+00:00",
        "timestamp": "1778654772",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1bc09595-cd77-466b-94a5-2e5d1396ef68",
        "value": "64.137.42.99",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T06:54:48.111841+00:00",
        "timestamp": "1778655290",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "668c4bb3-cc48-43c6-8db8-199634adc721",
        "value": "64.62.156.38",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T06:56:29.291739+00:00",
        "timestamp": "1778655391",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ee44bb77-f0e5-4b44-97d3-181805a55a8f",
        "value": "20.220.233.65",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T07:05:33.577757+00:00",
        "timestamp": "1778655936",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ea9a2744-7b10-44c1-af39-764768bd2ba6",
        "value": "31.58.19.15",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T07:05:44.900847+00:00",
        "timestamp": "1778655947",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0f2954bd-bf2c-4090-a450-0a12a08e77c3",
        "value": "2001:470:1:c84::21",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T07:05:49.760382+00:00",
        "timestamp": "1778655951",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1fd1c61b-e3d2-479a-8fa0-5da2bf05caeb",
        "value": "31.58.30.138",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T12:18:54.799487+00:00",
        "timestamp": "1778674737",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bb8df47e-0658-4198-9696-223f4a4056f2",
        "value": "172.212.217.10",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T13:22:35.277931+00:00",
        "timestamp": "1778678557",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "24734ee5-8d56-4b25-a800-e6482200ba42",
        "value": "64.62.156.192",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T19:05:30.404874+00:00",
        "timestamp": "1778699132",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b321f3d6-8b5b-4628-8fd4-a16efb2b2753",
        "value": "96.62.228.108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T19:37:50.514849+00:00",
        "timestamp": "1778701072",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "32983460-64a2-47aa-81f4-be98d2e93466",
        "value": "2602:fb54:1a00::10f",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-13T21:47:22.365192+00:00",
        "timestamp": "1778708843",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4e50df1c-2c84-4ee5-b6d3-32872c3ce195",
        "value": "34.11.177.1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}