{
  "Event": {
    "analysis": "1",
    "date": "2026-04-05",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-05",
    "publish_timestamp": "1775429952",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1775429952",
    "uuid": "cfd35589-baba-4335-92d7-ee5bc0f773a9",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T03:44:53.657569+00:00",
        "timestamp": "1775360695",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d01cbf00-5b3c-4dc1-8e7f-69b40eef5e72",
        "value": "2a01:4f9:3100:1114::2",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T06:03:27.398257+00:00",
        "timestamp": "1775369008",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7f7d9b7b-a8cf-44de-aa78-5f594a986dcc",
        "value": "43.166.130.123",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 165.154.252.65 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T10:00:22.779601+00:00",
        "timestamp": "1775383228",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5c4f536d-5740-412b-8edd-393e8ddef6ef",
        "value": "165.154.252.65",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T10:56:39.189682+00:00",
        "timestamp": "1775386601",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "658c0c09-ba8c-4aa2-b89f-556867c90a79",
        "value": "157.230.36.222",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T13:24:39.802679+00:00",
        "timestamp": "1775395481",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ecc63ab9-a547-4731-b83b-87c1d96db8aa",
        "value": "185.177.72.49",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T14:41:53.883722+00:00",
        "timestamp": "1775400116",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "35dee751-99ef-43f3-a63b-f83e45482133",
        "value": "2a09:bac5:55ff:30c8::4dc:46",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request for Visual Studio Code sftp.json - Possible Information Leak",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T14:41:58.958501+00:00",
        "timestamp": "1775400121",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "11af35ba-8684-4309-b59b-8c2d841a7ad4",
        "value": "2a09:bac6:d69e:30c8::4dc:46",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T18:05:39.549173+00:00",
        "timestamp": "1775412341",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "67bf3102-81b0-4471-a121-83f13a6ecf62",
        "value": "172.70.248.183",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T18:06:07.354941+00:00",
        "timestamp": "1775412369",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9644d1db-c1f5-495a-a636-60c89d62a61a",
        "value": "172.70.248.182",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-05T22:59:10.208118+00:00",
        "timestamp": "1775429952",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3b3b7895-4ffc-4f9f-a037-5616d93fecdf",
        "value": "125.209.235.180",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}