{
  "Event": {
    "analysis": "1",
    "date": "2026-02-04",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-04",
    "publish_timestamp": "1770249432",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1770249413",
    "uuid": "a857e9fe-d03f-4a78-a9f7-19c0d3ec31f8",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T01:08:38.490100+00:00",
        "timestamp": "1770167320",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dc021359-3a5f-463c-9fb3-b930ad75ac8e",
        "value": "2620:96:e000::118",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T01:08:42.479981+00:00",
        "timestamp": "1770167324",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4bd4daa4-b5f4-432c-9e5f-712e050e46b3",
        "value": "66.132.153.120",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T01:25:25.806467+00:00",
        "timestamp": "1770168327",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9d075197-e3c4-4988-a627-fb8e4ab94bae",
        "value": "114.111.32.25",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T04:07:46.595832+00:00",
        "timestamp": "1770178068",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "95fe7459-06b2-475c-8bc7-e9b7c7680545",
        "value": "162.142.125.200",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T05:25:30.028037+00:00",
        "timestamp": "1770182731",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ea39e6b7-e324-4c98-b86b-709279d2ede9",
        "value": "2001:470:2cc:1:63c6:e064:430f:f08d",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T11:58:02.190050+00:00",
        "timestamp": "1770206283",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "70d1719e-87a1-47f2-bbdf-08b18038b38c",
        "value": "199.45.155.83",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T16:34:14.971599+00:00",
        "timestamp": "1770222856",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6e14f7e7-476a-4e77-ae81-1e86e3abc112",
        "value": "52.169.148.186",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T21:02:55.275836+00:00",
        "timestamp": "1770238977",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4fbfe529-a020-4dbe-8419-8a63cc6b04d0",
        "value": "2402:d400:5:1::91",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T21:44:29.013963+00:00",
        "timestamp": "1770241470",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "103507c7-b848-4d64-ba4e-ddab0314f3d0",
        "value": "2602:80d:1006::6b",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-04T23:56:52.165305+00:00",
        "timestamp": "1770249413",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f166bf33-3f1f-49d6-b00b-e23fb48b108a",
        "value": "185.18.59.118",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}