{
  "Event": {
    "analysis": "1",
    "date": "2026-01-21",
    "extends_uuid": "",
    "info": "KRVTZ IDS alerts for 2026-01-21",
    "publish_timestamp": "1769039003",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769039003",
    "uuid": "634c13e8-6852-4624-b02e-b6e74b454a1f",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#bf8e0e",
        "local": false,
        "name": "KRVTZ-NET:information-gathering=\"scanner\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T06:28:19.936583+00:00",
        "timestamp": "1768976901",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "be9ee580-a328-45c6-b23b-eda57a966e49",
        "value": "2001:470:1:fb5::160",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T06:54:02.225271+00:00",
        "timestamp": "1768978444",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d436b82a-466f-4517-ba14-71c4cea56150",
        "value": "2620:96:e000::d9",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T09:03:31.486434+00:00",
        "timestamp": "1768986212",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "25f84860-6ef9-40e2-be89-9af6b89f2bd4",
        "value": "2600:3c02::2000:c5ff:fe30:d03b",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T10:55:41.937972+00:00",
        "timestamp": "1768992943",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0b16f34a-f43d-40ec-89ee-d33791752b19",
        "value": "188.166.226.108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T11:42:46.491289+00:00",
        "timestamp": "1768995768",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4b6f7787-edc3-4bff-a5fa-8fa20718a8de",
        "value": "45.79.252.178",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T13:18:26.873208+00:00",
        "timestamp": "1769001508",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ba226e20-29e0-4c9e-b0a0-b0e12a3e01b4",
        "value": "167.94.138.187",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "-  Expired TLS Certificate",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T13:37:57.269717+00:00",
        "timestamp": "1769002678",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8e4a64d6-affe-49e9-afb6-c5a4ffc6d643",
        "value": "2a04:4040:5::18",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T14:24:54.647969+00:00",
        "timestamp": "1769005496",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "faa702cc-a4ea-406a-8e6e-adcaae988f3d",
        "value": "162.142.125.207",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T17:22:46.872386+00:00",
        "timestamp": "1769016168",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5a7608e9-11a6-48b5-9cee-e9292af6de28",
        "value": "185.100.157.14",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T18:48:34.328413+00:00",
        "timestamp": "1769021315",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dc1223cb-718a-4c97-99e1-08fbf4d9c513",
        "value": "65.52.167.153",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T19:16:23.011454+00:00",
        "timestamp": "1769022984",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9c504c2b-b8b2-4d71-9c07-bff5029b2731",
        "value": "4.194.34.171",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T20:34:01.435495+00:00",
        "timestamp": "1769027642",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9371fa48-df7f-4ddf-9f81-8f718ab7ca74",
        "value": "152.42.222.25",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T20:57:49.050847+00:00",
        "timestamp": "1769029070",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "01e295c9-bfe9-4982-bd41-6e99bc5fab5e",
        "value": "2001:ee0:490a:a27c:d13a:bb13:5dc:7d6f",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-21T23:43:21.766898+00:00",
        "timestamp": "1769039003",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d22d0067-7bb4-4c19-b116-67062a2c3800",
        "value": "192.145.205.34",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}