{
  "Event": {
    "analysis": "1",
    "date": "2026-02-09",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-09",
    "publish_timestamp": "1770675009",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1770675009",
    "uuid": "98ab93e1-24e2-4e29-82e3-a4c616761583",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "haproxy: 152.32.151.39 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T02:46:04.284472+00:00",
        "timestamp": "1770605166",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5c06fcfa-cc27-4bd1-a0b0-7a99a44b1994",
        "value": "152.32.151.39",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T03:08:29.782308+00:00",
        "timestamp": "1770606511",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a855f47d-b8ea-464d-bad8-c7528abc90c2",
        "value": "2001:470:1:332::148",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T04:24:24.832919+00:00",
        "timestamp": "1770611066",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "66f72fbf-b638-4ba4-afba-7d973010c390",
        "value": "165.165.120.46",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T05:10:59.172853+00:00",
        "timestamp": "1770613860",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c25cc0d6-9d94-4b05-8915-f2fcee6df137",
        "value": "14.176.76.54",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T09:40:08.798713+00:00",
        "timestamp": "1770630010",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "783469ed-cff8-44c1-8313-e48b8017eacf",
        "value": "14.244.210.136",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T13:04:41.362099+00:00",
        "timestamp": "1770642283",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0f7263fa-e592-429c-9a1d-577bbc9425ca",
        "value": "167.94.138.52",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T15:52:16.798882+00:00",
        "timestamp": "1770652338",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6e50ece9-00ab-47b9-ada6-ba868bd815f8",
        "value": "14.191.47.13",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-09T22:10:07.143771+00:00",
        "timestamp": "1770675009",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3f2e217e-a59b-4cfc-8935-df81cc380ae8",
        "value": "113.186.42.139",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}