{
  "Event": {
    "analysis": "1",
    "date": "2026-01-29",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-01-29",
    "publish_timestamp": "1769720163",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1769720162",
    "uuid": "dc95a8f8-8065-4e0a-afd9-e00a25b84c93",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T01:17:21.507497+00:00",
        "timestamp": "1769649443",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4848f43a-aab0-4fdc-ba8b-30c79e514ace",
        "value": "104.237.57.26",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T04:15:03.255612+00:00",
        "timestamp": "1769660105",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "867b0ada-3d84-41b8-9317-0db7828c1012",
        "value": "2001:470:1:fb5::240",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T12:33:37.908827+00:00",
        "timestamp": "1769690019",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b4521a87-a081-4c5d-b242-5a87b5e8ddbb",
        "value": "18.130.206.21",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T14:26:05.594384+00:00",
        "timestamp": "1769696767",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a877a9b2-d290-45b8-801c-0fea41fb7962",
        "value": "37.215.8.127",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T16:01:10.435109+00:00",
        "timestamp": "1769702472",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d0ea2b3b-2844-4811-be49-486c4148e7ec",
        "value": "181.215.182.46",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T18:16:23.808796+00:00",
        "timestamp": "1769710585",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d4d4c805-20e0-434d-a4c1-1122af6ec6d6",
        "value": "162.142.125.222",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T18:46:46.036321+00:00",
        "timestamp": "1769712407",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "80ae9318-9e2c-407b-86b4-6f7307d3a24c",
        "value": "91.99.221.179",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-01-29T20:56:01.314028+00:00",
        "timestamp": "1769720162",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "25561f70-e6a8-43e0-a725-e055c4d8f7b4",
        "value": "199.45.155.70",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}