{
  "Event": {
    "analysis": "1",
    "date": "2026-01-30",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-01-30",
    "publish_timestamp": "1769806046",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769806046",
    "uuid": "69399bdb-b06e-4f2f-b904-0096fa4e7717",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T00:38:46.377312+00:00",
        "timestamp": "1769733528",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d3a8b6c8-4ff5-4338-a94c-c613259bd02a",
        "value": "74.220.26.44",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T03:28:10.904260+00:00",
        "timestamp": "1769743692",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "03866b44-81ae-4d13-b506-918b1dcc10f2",
        "value": "206.168.34.221",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T08:50:47.692464+00:00",
        "timestamp": "1769763049",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "186033c6-ebfc-439a-b5c2-df2fa879223f",
        "value": "38.242.247.242",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T11:07:30.004274+00:00",
        "timestamp": "1769771251",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d7113697-8b8f-44b7-96c3-a219d3e1e576",
        "value": "130.12.182.73",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Web shell hunting (banned): /.well-known/gecko-litespeed.php",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T11:28:38.221121+00:00",
        "timestamp": "1769772519",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f7370fc5-c125-4a4a-8163-d6706e7fc351",
        "value": "52.169.206.229",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T13:23:27.058287+00:00",
        "timestamp": "1769779408",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ccc13f7d-d5e0-41c8-8487-ca7e8b66409d",
        "value": "2602:80d:1003::31",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T13:23:35.386010+00:00",
        "timestamp": "1769779416",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9458c5db-ee02-4142-9150-48bd356d4a12",
        "value": "199.45.154.145",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T18:45:00.138694+00:00",
        "timestamp": "1769798701",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "28548004-1b55-4adc-bbc4-891b92337d21",
        "value": "185.193.89.19",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T20:16:20.283852+00:00",
        "timestamp": "1769804182",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1f0664e2-8bfc-46a7-8225-7751d98144a2",
        "value": "162.142.125.117",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-30T20:47:24.766327+00:00",
        "timestamp": "1769806046",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "02bccf7e-3ad1-4a3c-b24f-86f8a3e5faf7",
        "value": "2620:96:e000::10e",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}