{
  "Event": {
    "analysis": "1",
    "date": "2026-02-06",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-06",
    "publish_timestamp": "1770407491",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1770407491",
    "uuid": "bd9674e9-efc6-40ca-a1bf-1186337eb168",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T04:16:26.584605+00:00",
        "timestamp": "1770351388",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "41d11b16-8bb9-4ab9-a47d-33e2eb493bf2",
        "value": "196.77.2.167",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 165.154.36.245 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T05:05:27.633576+00:00",
        "timestamp": "1770354329",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d44cab09-3b3c-4665-a132-5959a17906d1",
        "value": "165.154.36.245",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T06:04:03.001681+00:00",
        "timestamp": "1770357844",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "06c4ad0d-2018-4c48-9763-3781d0580051",
        "value": "162.142.125.197",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T07:10:39.051087+00:00",
        "timestamp": "1770361840",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "670f02ed-4018-4aa9-8f90-040c123f27ab",
        "value": "66.249.92.41",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T14:07:32.322679+00:00",
        "timestamp": "1770386853",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e128fe77-de73-4623-a2a1-c16547d6f942",
        "value": "2001:470:2cc:1::19f",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T17:29:49.811732+00:00",
        "timestamp": "1770398991",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "03fff76f-f056-4596-a461-a0bffb695350",
        "value": "43.153.47.201",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T17:50:46.252832+00:00",
        "timestamp": "1770400247",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0edb9223-35f5-400a-bcf0-acc90d38d7bb",
        "value": "43.157.170.126",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T17:59:27.977421+00:00",
        "timestamp": "1770400769",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bc28895b-f9d8-45c1-b43a-7a5a323d2b9c",
        "value": "43.133.187.11",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T18:15:07.120438+00:00",
        "timestamp": "1770401708",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a16a8d18-ad27-4afc-994d-a87ac3a5089c",
        "value": "43.130.74.193",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T18:20:46.449980+00:00",
        "timestamp": "1770402047",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "feca07ca-65df-4666-bbe8-2b230d912476",
        "value": "43.153.107.22",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-06T19:51:29.541969+00:00",
        "timestamp": "1770407491",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6600c9c0-e64f-41ff-97bc-54f895cee169",
        "value": "167.94.138.35",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}