{
  "Event": {
    "analysis": "1",
    "date": "2026-04-11",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-11",
    "publish_timestamp": "1775943295",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1775943282",
    "uuid": "749f284d-1c60-44fe-a46e-4dbbecd4c9f1",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T00:35:43.156209+00:00",
        "timestamp": "1775867745",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3ad45ae2-09fc-4206-98c1-22381efe1874",
        "value": "135.232.240.156",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T03:53:53.515133+00:00",
        "timestamp": "1775879634",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e0e2c433-dac8-474b-9238-ef39a94a4656",
        "value": "2001:470:1:c84::15",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T10:13:32.735705+00:00",
        "timestamp": "1775902414",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d4bcd39b-d28d-423b-b400-f4655f037185",
        "value": "2a02:4780:5e:537::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T10:16:37.488279+00:00",
        "timestamp": "1775902599",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f4373fb6-dc73-4117-b5ed-4e15d694f909",
        "value": "2a02:4780:5e:9742::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T10:18:51.230491+00:00",
        "timestamp": "1775902733",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "104ed0f0-499e-4131-8cf0-39ee9cdd0798",
        "value": "2a02:4780:5e:c732::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T10:25:50.678079+00:00",
        "timestamp": "1775903153",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9656e26c-76a9-4ffc-bd39-9546a9d9ed2d",
        "value": "2a02:4780:5e:c613::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T10:27:48.516363+00:00",
        "timestamp": "1775903270",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ea26369e-0823-497d-97ad-8aa5995f8862",
        "value": "2a02:4780:5e:9ec8::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T16:33:13.316193+00:00",
        "timestamp": "1775925195",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d7683d85-8b8b-403c-8e2e-1552c8e6edfb",
        "value": "2a02:4780:5e:78e0::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T17:10:08.296815+00:00",
        "timestamp": "1775927410",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "20752d34-5421-4553-8689-8fa64ad26382",
        "value": "2a02:4780:5e:825e::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T17:25:19.375972+00:00",
        "timestamp": "1775928321",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "75b5f125-601e-4e68-9965-db0c5dcc2b8e",
        "value": "2a02:4780:5e:3c05::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T17:27:18.236030+00:00",
        "timestamp": "1775928440",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6353cc84-cd1c-480d-a491-9b016f39d8fc",
        "value": "2a02:4780:5e:cd8::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T17:50:26.229977+00:00",
        "timestamp": "1775929828",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "24cefa7a-52a2-4bcc-b91a-fec730bd747f",
        "value": "2a02:4780:5e:bc7f::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T18:48:01.751196+00:00",
        "timestamp": "1775933283",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "96797a53-4aa7-40ff-8796-cd7e8080c5a0",
        "value": "2606:65c0:20:425:7acf:66cc:b986:dab0",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T18:57:42.997086+00:00",
        "timestamp": "1775933864",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e484dcc0-6399-4661-bb6e-f52090a6000d",
        "value": "2a02:4780:5e:80f4::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T19:16:54.268602+00:00",
        "timestamp": "1775935015",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f1f52c9a-4078-4b43-8d7e-9bccf184bf6a",
        "value": "2a02:4780:5e:8e8e::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T19:34:58.624540+00:00",
        "timestamp": "1775936100",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5ab1cb23-0474-479e-871a-787fe43cc84f",
        "value": "2a02:4780:5e:d8be::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T19:40:18.957537+00:00",
        "timestamp": "1775936420",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9714e411-5bfc-4b4f-b648-154aca70ed23",
        "value": "2a02:4780:5e:ce5c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T19:55:39.968536+00:00",
        "timestamp": "1775937341",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ec26c38c-a868-4fcd-b7fe-2ed365a29ca3",
        "value": "2a02:4780:5e:8267::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T19:59:03.130738+00:00",
        "timestamp": "1775937544",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b863a681-3f49-4828-9f28-e53254991962",
        "value": "43.153.204.189",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T21:34:41.116041+00:00",
        "timestamp": "1775943282",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "026b035c-5345-43ed-b750-5e3043d39d4a",
        "value": "2a02:4780:5e:9d1c::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}