{
  "Event": {
    "analysis": "1",
    "date": "2026-02-19",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-19",
    "publish_timestamp": "1771542410",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771542397",
    "uuid": "dba3bd37-197f-456f-a925-f712bb70dda5",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T04:48:44.809343+00:00",
        "timestamp": "1771476526",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f0e3ba59-27ef-4c2f-8801-c6e33f877b91",
        "value": "15.207.110.38",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T04:58:20.358622+00:00",
        "timestamp": "1771477101",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5498c029-9e43-449b-a34f-c66e0e862425",
        "value": "210.193.124.54",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T04:58:37.462365+00:00",
        "timestamp": "1771477118",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "07185e93-761f-45a7-95d8-a32f6f2f8e7b",
        "value": "135.233.67.152",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T04:58:57.702972+00:00",
        "timestamp": "1771477139",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5d422c91-d703-44cb-841f-c69f6b929fe8",
        "value": "40.114.54.152",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T04:59:13.543038+00:00",
        "timestamp": "1771477155",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "72a52d88-066f-4410-b418-fac233d99343",
        "value": "217.154.251.221",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T05:00:14.266518+00:00",
        "timestamp": "1771477218",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c41739fc-effa-4520-aabc-327632925b25",
        "value": "168.231.107.113",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T05:27:16.583674+00:00",
        "timestamp": "1771478838",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d5a4b54d-67a4-4c5c-9e04-9926ead69999",
        "value": "45.3.43.102",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T05:28:33.037678+00:00",
        "timestamp": "1771478914",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "eb91abde-c751-4b5e-84ec-20cd6c5c4a6d",
        "value": "104.207.41.109",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T06:19:53.005301+00:00",
        "timestamp": "1771481994",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2567600c-d5d5-41c5-a075-8727e04a5d74",
        "value": "2001:470:1:fb5::200",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T06:55:41.659999+00:00",
        "timestamp": "1771484143",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6a41c208-4e23-4488-a4ef-ca8f824a187a",
        "value": "34.135.13.85",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T06:59:29.261123+00:00",
        "timestamp": "1771484370",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0fef15a1-f1f4-4510-88c0-0d8ec3f1ca40",
        "value": "88.119.166.144",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:10:02.521366+00:00",
        "timestamp": "1771485004",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ede25479-ab55-469d-a78c-09807f61d462",
        "value": "113.13.111.161",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:10:10.841213+00:00",
        "timestamp": "1771485012",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ce73377f-fc30-4b30-b300-b32718fc702e",
        "value": "154.36.128.203",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:10:20.375311+00:00",
        "timestamp": "1771485022",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4433577c-e968-4300-be94-768eb6a69469",
        "value": "158.160.43.34",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:10:40.045939+00:00",
        "timestamp": "1771485041",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "065016b7-21f4-4917-b8d2-8cc7ec9aecee",
        "value": "46.242.128.126",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:10:57.436191+00:00",
        "timestamp": "1771485059",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "01b3ccfc-ca86-419e-a65e-ba8d0a2797b4",
        "value": "177.128.224.67",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:11:18.251936+00:00",
        "timestamp": "1771485080",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "75259148-f82f-45b8-b0d9-45d0a747914e",
        "value": "15.206.86.55",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T07:13:44.810123+00:00",
        "timestamp": "1771485227",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "05b0fd11-9f18-419c-b69c-08d2531f7f6c",
        "value": "68.40.92.150",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT HTTP Request to 127.0.0.1",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T08:21:45.366852+00:00",
        "timestamp": "1771489306",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "905315aa-b494-4fe1-903a-bd9ac3896d0f",
        "value": "::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T09:37:29.448358+00:00",
        "timestamp": "1771493850",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "956059ae-49bc-4cb4-916f-95c518379ad4",
        "value": "93.123.109.214",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T17:46:35.959400+00:00",
        "timestamp": "1771523197",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8e70a79b-e787-42bd-a5b5-1ca071a3cac2",
        "value": "2601:647:6801:6c70:1046:8937:a805:8424",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T18:27:36.598950+00:00",
        "timestamp": "1771525658",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9bd0850d-17b4-4986-ad0e-4e4247002ac0",
        "value": "163.7.3.41",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-19T23:06:35.978773+00:00",
        "timestamp": "1771542397",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c464fb1c-f5d1-4d95-98f5-d8f98d09f972",
        "value": "141.98.11.107",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}