{
  "Event": {
    "analysis": "1",
    "date": "2026-04-12",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-12",
    "publish_timestamp": "1776032870",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1776032869",
    "uuid": "78407fea-a3a8-4ecf-b340-d1c5a3afade9",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T23:18:24.713247+00:00",
        "timestamp": "1775949506",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "63fd3212-28cd-4988-a69b-99e32b72d423",
        "value": "104.28.239.219",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-11T23:19:35.609787+00:00",
        "timestamp": "1775949577",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a14e3f51-e9d4-4139-975b-00ff163d0b76",
        "value": "2a09:bac5:2f1e:2482::3a3:2d",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T00:46:18.273045+00:00",
        "timestamp": "1775954779",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "88d007d2-1c82-497e-9725-ae53d5a13a81",
        "value": "88.151.34.241",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T01:15:17.620371+00:00",
        "timestamp": "1775956519",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "63e0e0aa-0ff5-4685-9c50-b81973ac9733",
        "value": "66.187.6.102",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Http Client Body contains pwd= in cleartext",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T09:05:13.002198+00:00",
        "timestamp": "1775984714",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7d3edf4a-10dc-4905-af6e-133142834575",
        "value": "217.142.185.154",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T10:38:58.043437+00:00",
        "timestamp": "1775990340",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "15a4e4dc-3882-4883-8c2e-88cad6c94c1f",
        "value": "125.209.235.168",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T10:39:02.397470+00:00",
        "timestamp": "1775990344",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "050da39a-70cc-4bc1-ac68-d9d55c965394",
        "value": "211.249.46.50",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T18:16:26.240011+00:00",
        "timestamp": "1776017788",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ce6b137b-9e49-4f71-8e42-79d20d0eec6f",
        "value": "2a09:bac1:5ba0:d60::38a:7d",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T21:24:51.835043+00:00",
        "timestamp": "1776029093",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3d8319c6-abf7-496b-be80-6b8aa35fdda3",
        "value": "46.248.72.177",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T21:40:53.598024+00:00",
        "timestamp": "1776030055",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "36687c57-afcb-4851-a465-41549425b1d2",
        "value": "187.127.100.173",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T21:46:42.546932+00:00",
        "timestamp": "1776030404",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1f64556a-e717-465b-83e6-cb95df3ed87c",
        "value": "2a02:4780:5e:5c25::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T21:54:57.445750+00:00",
        "timestamp": "1776030898",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d7732932-0d69-4ead-b04d-7f7e573f9038",
        "value": "2a02:4780:5e:d2e0::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T21:57:14.104530+00:00",
        "timestamp": "1776031035",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "fc6a04c7-23e6-4a00-9c34-db19c4c5d1a8",
        "value": "2a02:4780:5e:9c00::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-12T22:27:47.535022+00:00",
        "timestamp": "1776032869",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "17a5cf21-c50c-4163-8da7-0df3fb836c55",
        "value": "43.134.186.61",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}