{
  "Event": {
    "analysis": "1",
    "date": "2026-01-25",
    "extends_uuid": "",
    "info": "KRVTZ IDS alerts for 2026-01-25",
    "publish_timestamp": "1769380044",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769380043",
    "uuid": "cf92f9cb-6841-47fe-8d57-9c4caa25c89a",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#bf8e0e",
        "local": false,
        "name": "KRVTZ-NET:information-gathering=\"scanner\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T00:03:16.524778+00:00",
        "timestamp": "1769299398",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "af57939f-e1d6-44dc-9def-e7a77bfd4357",
        "value": "2620:96:e000::108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 149.28.234.82 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T00:23:57.415412+00:00",
        "timestamp": "1769300639",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "245292fd-859d-4958-98c7-764b3bc1786d",
        "value": "149.28.234.82",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T00:54:04.651811+00:00",
        "timestamp": "1769302446",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "756cab4b-e25d-4912-96f5-f58491e88ae5",
        "value": "157.33.40.31",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T00:58:07.985493+00:00",
        "timestamp": "1769302689",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5b68b509-4acf-40d1-8ac1-fbf665e7bc5b",
        "value": "190.49.100.237",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T04:14:14.936226+00:00",
        "timestamp": "1769314456",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a946647b-34bb-4c61-96e9-e671d2cde726",
        "value": "88.182.195.86",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T04:54:36.161058+00:00",
        "timestamp": "1769316877",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2db8899a-185a-45bd-97eb-12abc3aef2b8",
        "value": "2804:21ac:756:3200:5827:f464:d2e2:bf00",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T04:56:44.528023+00:00",
        "timestamp": "1769317006",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0ce2123c-6aa4-4925-a021-f64054414d15",
        "value": "86.26.48.29",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T05:13:55.549958+00:00",
        "timestamp": "1769318037",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a7274fbf-313f-46bc-bfb9-bc300428e03e",
        "value": "200.92.181.221",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T05:20:37.562539+00:00",
        "timestamp": "1769318439",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ffcf7c56-751e-456f-affc-2098e943075f",
        "value": "103.231.35.130",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T05:21:02.179854+00:00",
        "timestamp": "1769318463",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "08095fe2-7a65-4ddb-aa64-13829506e837",
        "value": "178.134.233.24",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T05:27:03.920185+00:00",
        "timestamp": "1769318825",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9db0e6c2-4006-4f09-9444-af49779521d7",
        "value": "2001:470:2cc:1::17f",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T05:56:12.955619+00:00",
        "timestamp": "1769320574",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ec7634b6-6664-4896-a22c-3c379dfca6d0",
        "value": "49.47.10.144",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T07:39:46.894547+00:00",
        "timestamp": "1769326788",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "709d231f-7dcc-40c1-b2d5-ce2be9c4e82a",
        "value": "185.177.72.62",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T08:02:13.928031+00:00",
        "timestamp": "1769328135",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e9843734-471e-424a-b6b2-4142093703d1",
        "value": "195.178.110.109",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T08:11:22.124631+00:00",
        "timestamp": "1769328683",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "77710a9c-78c0-4f5f-afa5-dfb92efcd485",
        "value": "2001:470:2cc:1:77fb:ad48:8d45:26b0",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T09:04:24.978986+00:00",
        "timestamp": "1769331866",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2339d9a7-4a71-40c2-95c4-186e3c40173f",
        "value": "79.23.215.81",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T09:13:43.929228+00:00",
        "timestamp": "1769332425",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bf2f545f-453a-4523-95f3-ef13b6da1b31",
        "value": "152.42.205.177",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T09:25:06.642551+00:00",
        "timestamp": "1769333108",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c312b7e1-513c-4d78-9fd3-77c732610afe",
        "value": "20.70.170.217",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER IIS 8.3 Filename With Wildcard (Possible File/Dir Bruteforce)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T12:40:37.910751+00:00",
        "timestamp": "1769344839",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "43fbbb53-740c-4669-b5a0-faab536ae9a3",
        "value": "192.168.144.78",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T18:03:43.310577+00:00",
        "timestamp": "1769364224",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3d13f152-72de-4263-ac5b-c7103bc18e2d",
        "value": "194.61.9.180",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T18:56:28.783746+00:00",
        "timestamp": "1769367390",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "94a096f1-acb1-46bf-ac8e-2939dd3ad741",
        "value": "195.178.110.132",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T20:38:47.188222+00:00",
        "timestamp": "1769373529",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "12d7e90b-c95e-4e1f-8f75-c6314e9ef73e",
        "value": "152.97.178.250",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T22:07:22.551563+00:00",
        "timestamp": "1769378844",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "93c2a2dc-4b12-4c10-943d-83aaadeae4df",
        "value": "162.142.125.196",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Unsupported/Fake Windows NT Version 5.0",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-25T22:27:22.444772+00:00",
        "timestamp": "1769380043",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4ee4d6a9-57ff-45a2-9f73-28561a52e51e",
        "value": "177.66.99.24",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}