{
  "Event": {
    "analysis": "1",
    "date": "2026-02-13",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-13",
    "publish_timestamp": "1771020836",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771020836",
    "uuid": "62ee9654-4c05-4872-a4ac-9a2a7a51bc2c",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T00:11:46.149462+00:00",
        "timestamp": "1770941508",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f2f30052-8511-4559-93d8-1e06ed7cdca0",
        "value": "14.172.26.24",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T02:19:29.114036+00:00",
        "timestamp": "1770949170",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ee99ced3-fde0-42a7-9ed2-e4cc51f9a252",
        "value": "2001:470:2cc:1::1ff",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T06:52:19.700341+00:00",
        "timestamp": "1770965541",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "be26f659-7570-47ad-9b15-75353acdc6b4",
        "value": "216.26.242.194",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T06:52:25.102954+00:00",
        "timestamp": "1770965546",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "357c55d3-78cb-4c47-84a7-c80ef6b65e59",
        "value": "104.207.32.90",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T06:58:38.472736+00:00",
        "timestamp": "1770965920",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "41512b78-1de8-4295-b76f-07733ed9e56c",
        "value": "66.132.153.117",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T06:59:08.624522+00:00",
        "timestamp": "1770965950",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8a3c199f-c351-4ecd-8ec1-a1b1d141404c",
        "value": "20.250.11.129",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T07:05:24.910692+00:00",
        "timestamp": "1770966326",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a1a4a8f7-54a4-436c-81e8-ca201d47c11d",
        "value": "162.142.125.202",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T08:07:20.623217+00:00",
        "timestamp": "1770970042",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a44b244c-239d-44f2-a688-d5c273d10ca9",
        "value": "167.94.138.61",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T09:21:45.992105+00:00",
        "timestamp": "1770974507",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2f7985a2-6a22-465c-9a5e-1e4b64ae5460",
        "value": "119.28.140.106",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T10:00:20.896885+00:00",
        "timestamp": "1770976826",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "02fbdfb8-3690-4422-8fe0-e14310b11f27",
        "value": "20.215.248.189",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T12:05:34.894795+00:00",
        "timestamp": "1770984336",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "39de3c7c-8185-4896-9c30-20e036de7932",
        "value": "2001:41d0:601:1100::4011",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T15:25:33.641694+00:00",
        "timestamp": "1770996335",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d1d623c7-fbb0-49ce-a249-f1eea26692f8",
        "value": "34.97.86.160",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T16:29:06.418524+00:00",
        "timestamp": "1771000147",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "644b47c6-233f-4da4-b7f3-8addfd4791ee",
        "value": "124.156.157.91",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T16:43:52.054398+00:00",
        "timestamp": "1771001033",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dd5036fe-2e27-4020-9cfc-37723b5fd7ea",
        "value": "170.106.181.163",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T16:53:41.904894+00:00",
        "timestamp": "1771001623",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8b320da9-307c-4159-bb1e-2432c8c488b7",
        "value": "43.131.253.14",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T17:20:15.817125+00:00",
        "timestamp": "1771003217",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a6c79b8f-e48c-4f3f-94b3-e0ea7d78d839",
        "value": "43.159.144.16",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T17:35:36.095513+00:00",
        "timestamp": "1771004137",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0913212c-9213-4f17-b90c-33ab760b0e51",
        "value": "43.153.62.161",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T17:35:51.252717+00:00",
        "timestamp": "1771004153",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b13a320c-059b-4e79-ac19-959a5113e086",
        "value": "172.213.220.6",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T17:36:39.983502+00:00",
        "timestamp": "1771004201",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ab486a0c-8cb6-491d-b7d7-269ed6554437",
        "value": "43.155.140.157",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T18:20:34.930434+00:00",
        "timestamp": "1771006836",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "61e72a6a-be3c-47e6-bcec-d17addde8fc3",
        "value": "125.209.235.180",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Drupalgeddon2 <8.3.9 <8.4.6 <8.5.1 RCE Through Registration Form (CVE-2018-7600)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T21:32:30.469535+00:00",
        "timestamp": "1771018352",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1d6b1928-cf4c-497d-a0c0-6429d4b31618",
        "value": "5.129.220.105",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T21:55:21.506112+00:00",
        "timestamp": "1771019723",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "76917ee7-0dfa-4cb5-a4c3-ad665e7767ca",
        "value": "170.106.35.153",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "GPL WEB_SERVER .htpasswd access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T21:58:40.926335+00:00",
        "timestamp": "1771019922",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "381fc8c7-4f64-4b07-988d-a80b40feba1a",
        "value": "2a06:1700:1:8f::51cc:166d",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T21:59:19.122819+00:00",
        "timestamp": "1771019960",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "782ab5d2-b698-406e-9ad0-4eb46fe5765a",
        "value": "185.246.191.54",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T22:11:34.661171+00:00",
        "timestamp": "1771020696",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "61a22321-4f13-4b74-8058-edc3f39a6238",
        "value": "15.235.145.73",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-13T22:13:54.602699+00:00",
        "timestamp": "1771020836",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a041c194-ac3c-4e10-98c2-f76874d6f691",
        "value": "43.153.85.46",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}