{
  "Event": {
    "analysis": "1",
    "date": "2026-02-20",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-20",
    "publish_timestamp": "1771615090",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771615090",
    "uuid": "a7d3600c-be93-4b46-8b2e-6957e3297c1a",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T00:58:54.149352+00:00",
        "timestamp": "1771549135",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "69c74507-59cf-4652-8e6f-9f788eda2522",
        "value": "125.209.235.172",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT HTTP Request to 127.0.0.1",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T01:14:10.064331+00:00",
        "timestamp": "1771550052",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8130fe11-11be-4e06-b58e-0dddba9f9a08",
        "value": "::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T02:53:03.887002+00:00",
        "timestamp": "1771555985",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d4e74232-58ab-4728-b1dd-dcfa656c27d8",
        "value": "2001:470:1:c84::24",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T03:52:48.487191+00:00",
        "timestamp": "1771559570",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "43d79e85-1cc1-46f9-b794-e3e524ae347b",
        "value": "91.215.85.12",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T06:29:22.790262+00:00",
        "timestamp": "1771568964",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "25e6d377-34fd-4d6b-8b44-a3814e9fb036",
        "value": "146.70.168.87",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T07:19:13.799150+00:00",
        "timestamp": "1771571955",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ce3fe89b-6ba4-4351-bf98-ec5f9b737fc1",
        "value": "163.7.3.41",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T08:07:48.497266+00:00",
        "timestamp": "1771574870",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "816a2242-2ea9-44c6-aece-36aed515f454",
        "value": "195.178.110.187",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T08:57:26.565229+00:00",
        "timestamp": "1771577848",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1957b166-7ed3-4379-84fe-5a428ab7c14b",
        "value": "114.111.32.199",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T08:57:30.445987+00:00",
        "timestamp": "1771577852",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "05c4c64e-71df-4a83-883f-e46ac63e690a",
        "value": "211.249.46.107",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T08:57:34.123924+00:00",
        "timestamp": "1771577855",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5c304669-1e54-4f15-ab2e-3850ab5b40cc",
        "value": "110.93.150.63",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T10:07:32.237591+00:00",
        "timestamp": "1771582054",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7162003b-339a-4914-9342-142bf22073b4",
        "value": "110.93.150.125",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T11:14:13.057309+00:00",
        "timestamp": "1771586054",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4ed4980e-e305-47ab-a602-f20ab3acec5a",
        "value": "141.98.11.171",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:40:09.477996+00:00",
        "timestamp": "1771594811",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e4a99c71-2ed2-4067-ab1a-f69137c58734",
        "value": "114.111.32.140",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:40:13.973019+00:00",
        "timestamp": "1771594815",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2cffd7f2-4b90-42c8-a598-b3071ae0b27f",
        "value": "114.111.32.79",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:40:17.943309+00:00",
        "timestamp": "1771594819",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "948ca674-2b4f-453d-a60a-da0fd64d6754",
        "value": "114.111.32.200",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:40:21.890276+00:00",
        "timestamp": "1771594823",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "203770c0-e6f0-473e-b370-2ed24439eb50",
        "value": "211.249.46.216",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:40:25.952121+00:00",
        "timestamp": "1771594827",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7272605d-a069-475c-b116-c9f49bd6bfe9",
        "value": "110.93.150.197",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:42:09.017027+00:00",
        "timestamp": "1771594930",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3784fefc-fa0c-4b64-a54e-b7e44fc609e3",
        "value": "125.209.235.181",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T13:42:13.235691+00:00",
        "timestamp": "1771594934",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dfcba0c9-91a0-4504-a467-5d8e4dd49416",
        "value": "211.249.46.137",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T14:29:22.756674+00:00",
        "timestamp": "1771597764",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2ccc9b5a-c6c0-41f3-b074-ed7495f4acf7",
        "value": "110.93.150.124",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T15:24:35.369206+00:00",
        "timestamp": "1771601076",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d09bbed1-e265-4ee0-abaa-02ed5dd9ca17",
        "value": "173.208.168.34",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T16:49:30.387547+00:00",
        "timestamp": "1771606172",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dcc0cef7-7c72-4952-9c07-53681fa8d998",
        "value": "124.156.225.181",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T17:00:38.823091+00:00",
        "timestamp": "1771606845",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "82855e3b-17d8-4c62-827b-524a36f20abf",
        "value": "43.130.110.130",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T19:12:01.858775+00:00",
        "timestamp": "1771614723",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b4811549-6cc8-4f21-a9aa-bf048f6b77dd",
        "value": "20.219.0.101",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-20T19:18:08.785026+00:00",
        "timestamp": "1771615090",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c6c697ac-0018-4817-90b9-9ef1e248dcaf",
        "value": "5.182.204.94",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}