{
  "Event": {
    "analysis": "1",
    "date": "2026-01-28",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-01-28",
    "publish_timestamp": "1769634343",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769634343",
    "uuid": "6e7e093f-b6be-4fa9-a16d-baf022cd286d",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T03:26:33.568287+00:00",
        "timestamp": "1769570795",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "438aa766-b7eb-4412-a90e-f3fa8bdc6804",
        "value": "41.104.54.158",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS Suspicious User-Agent (InfoBot)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T04:48:24.520702+00:00",
        "timestamp": "1769575706",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "454c0a0b-a02a-417a-9957-b4af66b53236",
        "value": "34.74.242.206",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T07:01:25.371718+00:00",
        "timestamp": "1769583687",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3466a3dd-7b8a-452d-b731-b7e5918ab810",
        "value": "20.78.169.245",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T12:37:47.619181+00:00",
        "timestamp": "1769603869",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cbd118cb-eff2-47ba-9ede-da7f0780401a",
        "value": "35.159.53.210",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T12:40:29.392602+00:00",
        "timestamp": "1769604030",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "41c3ea6c-669d-4b7b-b577-5420622fdbce",
        "value": "2602:80d:1004::11",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T12:55:59.432432+00:00",
        "timestamp": "1769604961",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c5aee841-df71-49ac-a816-f8acd102a020",
        "value": "206.168.34.127",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T14:01:07.973592+00:00",
        "timestamp": "1769608869",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "38bc43e3-52de-48c7-be91-9f60282682cc",
        "value": "125.209.235.182",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T14:01:11.869578+00:00",
        "timestamp": "1769608873",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9c0582ad-b239-4a6d-8c23-e61d8679bdc3",
        "value": "125.209.235.178",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T15:16:10.655917+00:00",
        "timestamp": "1769613372",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d705b827-de5d-4af9-8c5f-8e5e729d99d2",
        "value": "110.93.150.162",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T15:54:41.098366+00:00",
        "timestamp": "1769615682",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7ccb1b34-a62f-44f2-b072-ccc99437a5c8",
        "value": "2001:9e8:25e1:100:44b4:bda8:c3f5:cbce",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T18:31:19.787266+00:00",
        "timestamp": "1769625081",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6e04211c-90b4-4f9d-a396-2d16e7542803",
        "value": "167.94.138.201",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T19:15:33.147752+00:00",
        "timestamp": "1769627734",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8a006b45-c633-4a0b-bc79-be800e936098",
        "value": "45.134.79.134",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-28T21:05:41.789964+00:00",
        "timestamp": "1769634343",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "aca18e0b-ad89-4054-b22d-b5981fdc5f44",
        "value": "66.132.153.142",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}