{
  "Event": {
    "analysis": "1",
    "date": "2026-05-02",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-05-02",
    "publish_timestamp": "1777762467",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1777762463",
    "uuid": "9a3f60f4-addd-48ed-b450-5ca6cf4c4c0f",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T00:56:41.687505+00:00",
        "timestamp": "1777683403",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cd172396-d788-4c78-aeda-505f1d7389b6",
        "value": "103.120.132.17",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T01:32:30.144086+00:00",
        "timestamp": "1777685553",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "925937d0-46d3-48e5-b08e-27e2f69270a7",
        "value": "192.154.250.211",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T01:52:35.881386+00:00",
        "timestamp": "1777686757",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d8642f15-5b12-490d-adbb-79d946bbe3ab",
        "value": "45.148.10.194",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T02:15:20.448676+00:00",
        "timestamp": "1777688123",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d94d3997-9efd-466a-809d-17be4f2e6f44",
        "value": "43.162.103.213",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T02:27:49.528833+00:00",
        "timestamp": "1777688871",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "78f830b3-c59f-4680-ab2d-561fb52f6568",
        "value": "93.123.109.164",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T02:33:49.684993+00:00",
        "timestamp": "1777689231",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f615bd7f-06e2-4ed3-b6be-47127c909175",
        "value": "93.123.109.163",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T06:50:42.000230+00:00",
        "timestamp": "1777704644",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9cc1f391-06fb-496b-9d6a-5245babde8c6",
        "value": "104.222.187.150",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T06:50:50.085638+00:00",
        "timestamp": "1777704651",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d03a3d9d-43db-47e2-b6a5-a92f87564bf2",
        "value": "148.135.188.224",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T06:52:15.574004+00:00",
        "timestamp": "1777704736",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3118bdc1-104e-4e52-87bb-e88e43180931",
        "value": "161.123.131.95",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T06:52:38.349754+00:00",
        "timestamp": "1777704759",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d5ee770d-2550-4d37-9b00-2d9389b92037",
        "value": "194.5.3.8",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER PHP Possible php Remote File Inclusion Attempt",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T11:19:40.118252+00:00",
        "timestamp": "1777720781",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "21aa5891-7d0b-4812-b280-6097f05bd736",
        "value": "2400:6180:0:d2:0:2:b99b:d000",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T12:53:03.125184+00:00",
        "timestamp": "1777726385",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e7e19112-08cd-4e79-9abb-63223f95edd1",
        "value": "82.26.242.61",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T12:53:15.959791+00:00",
        "timestamp": "1777726398",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b118dc49-7671-4671-ad2f-55bbc8c2cba5",
        "value": "31.58.32.93",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T12:53:25.413658+00:00",
        "timestamp": "1777726408",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cf858bd7-1da7-484e-a180-c4e11904dcba",
        "value": "82.21.226.45",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T13:14:37.228591+00:00",
        "timestamp": "1777727680",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d0fbb653-a43a-4cbf-9a5e-d6c6dca8b0af",
        "value": "34.158.148.246",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T13:20:06.063089+00:00",
        "timestamp": "1777728007",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b60d81cb-ef0f-4de6-8a40-db275875ae4b",
        "value": "208.77.244.125",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T16:05:40.390529+00:00",
        "timestamp": "1777737942",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0dcb7e31-4d22-4fe7-997f-50dac86f2b28",
        "value": "43.165.167.69",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T16:26:44.336915+00:00",
        "timestamp": "1777739206",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "945cfbb5-2627-4037-afa3-a9ae599cc9ca",
        "value": "103.168.67.107",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T18:17:03.599537+00:00",
        "timestamp": "1777745825",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cafdd0d4-b1d9-43c8-bf81-d998973b2006",
        "value": "43.164.196.47",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 128.1.46.183 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T19:07:02.804397+00:00",
        "timestamp": "1777748824",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "75900cb7-e4d5-4c7e-9846-260d441b1c46",
        "value": "128.1.46.183",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T19:51:04.165036+00:00",
        "timestamp": "1777751465",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "360e89e9-19ff-493b-9345-08e509697bd9",
        "value": "43.165.7.135",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T19:59:24.622378+00:00",
        "timestamp": "1777751966",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f26682af-5b7b-4529-af5f-9699aa0fdfbb",
        "value": "43.165.174.53",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T20:20:36.355472+00:00",
        "timestamp": "1777753238",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ce9a0579-2985-4c07-bcd2-0c581f060ba5",
        "value": "43.164.0.21",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T20:24:20.093852+00:00",
        "timestamp": "1777753462",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "11ac3e8b-2290-4136-9214-b5cc2e36427d",
        "value": "43.162.95.192",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T20:39:05.743995+00:00",
        "timestamp": "1777754348",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c9187565-1ca9-40f6-a67b-e004088a3f9b",
        "value": "176.65.139.168",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T21:08:08.470086+00:00",
        "timestamp": "1777756090",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a621d20c-2784-47dd-9ad1-8bff72978695",
        "value": "111.90.182.94",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T21:09:36.587451+00:00",
        "timestamp": "1777756178",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "86551799-d64a-4c39-a1a6-52744e01867f",
        "value": "92.113.119.97",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T22:35:30.669510+00:00",
        "timestamp": "1777761332",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2c9478ab-4042-4fec-b03f-e3d13a517f73",
        "value": "103.8.27.27",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-02T22:54:21.701418+00:00",
        "timestamp": "1777762463",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "517ebbea-3cd9-463a-ac17-a98b50bab973",
        "value": "82.26.222.15",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}