{
  "Event": {
    "analysis": "1",
    "date": "2026-02-12",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-12",
    "publish_timestamp": "1770928213",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1770927958",
    "uuid": "a69af19a-8672-4a6f-955e-13d05a6500e0",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T00:41:51.742583+00:00",
        "timestamp": "1770856913",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "49b24e48-a066-43a3-8d5f-77fdbc00d4aa",
        "value": "2602:80d:1003::11",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T05:55:27.348215+00:00",
        "timestamp": "1770875729",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8576dd16-452d-4dc9-8d95-9745c5f8917e",
        "value": "2001:470:1:332::19",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T06:07:47.469920+00:00",
        "timestamp": "1770876468",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "465418c8-28b4-45f2-815e-c67a7f41ed79",
        "value": "162.142.125.113",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T07:12:25.437843+00:00",
        "timestamp": "1770880347",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5f08407f-a3f1-4701-b549-de0ed062929f",
        "value": "167.94.138.197",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T08:15:10.831555+00:00",
        "timestamp": "1770884112",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8ce1057e-fa10-424f-8041-31d3b651910f",
        "value": "43.130.101.151",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Web shell hunting (banned): /.well-known/index.php",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T10:26:40.710135+00:00",
        "timestamp": "1770892002",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6d910213-5fb9-4abd-9394-56e176104a50",
        "value": "68.221.134.142",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T11:26:50.993569+00:00",
        "timestamp": "1770895612",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c0027ea5-ec63-4af5-8213-6773c45fc70e",
        "value": "113.162.199.156",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T13:00:13.198223+00:00",
        "timestamp": "1770901218",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b3430d7e-a960-4504-8a98-282e41a7aab1",
        "value": "2602:80d:1003::2a",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T14:38:30.059676+00:00",
        "timestamp": "1770907111",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e77b1439-b3a2-4aed-a1b4-727bf4f9f0ca",
        "value": "113.176.203.64",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T15:16:52.431166+00:00",
        "timestamp": "1770909414",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "75d93060-5f30-483a-a670-ed02eb8dcbf1",
        "value": "125.209.235.176",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T15:17:59.524065+00:00",
        "timestamp": "1770909481",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c4f8beba-0e9b-46ce-b3b8-9339e3a67ebf",
        "value": "114.111.32.166",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T18:05:58.125201+00:00",
        "timestamp": "1770919559",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "40ddf72b-3c21-423c-a90e-161f68cad4c3",
        "value": "209.50.185.162",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T18:06:02.282379+00:00",
        "timestamp": "1770919564",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9200ad14-ebf1-4a5e-a990-25a5f969b957",
        "value": "216.26.243.39",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T18:23:55.847976+00:00",
        "timestamp": "1770920637",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "46d4a62a-8064-421c-96ef-452689291375",
        "value": "51.120.71.235",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T19:23:07.005521+00:00",
        "timestamp": "1770924188",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0ff55b7c-1515-4b4a-87da-e931329b0720",
        "value": "123.26.204.250",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T19:53:17.843871+00:00",
        "timestamp": "1770925999",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c10306ea-95ae-4687-ad59-cbb2aa14cdbf",
        "value": "65.111.14.179",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T19:53:21.773254+00:00",
        "timestamp": "1770926003",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "704f54f3-b5bf-4459-bdb3-2ff43700d610",
        "value": "65.111.26.169",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-12T20:25:56.605612+00:00",
        "timestamp": "1770927958",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "015706cd-bcd9-4697-b1a4-5e89baca31e1",
        "value": "113.181.74.10",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}