{
  "Event": {
    "analysis": "1",
    "date": "2026-05-17",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-05-17",
    "publish_timestamp": "1779054729",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1779054729",
    "uuid": "e254b51f-abab-43cf-b069-d1cdd0646bbb",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T01:22:02.519118+00:00",
        "timestamp": "1778980924",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "80971bf4-2d7d-4b31-bacb-407f70806fbe",
        "value": "2602:fb54:1a00::50",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T02:03:38.898873+00:00",
        "timestamp": "1778983420",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b6a4313e-9a3f-472a-b002-74459fdea09c",
        "value": "43.153.26.165",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T02:10:58.909938+00:00",
        "timestamp": "1778983860",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5e802c63-8bba-4fa0-b128-69dfe24ce484",
        "value": "43.130.116.87",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T02:49:55.544603+00:00",
        "timestamp": "1778986196",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1f8ee256-ea69-42d4-b22b-b70c30d63b15",
        "value": "64.62.156.66",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T03:56:23.365202+00:00",
        "timestamp": "1778990185",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ce8398e1-b117-476c-8dd1-77b4f3de89c4",
        "value": "2001:470:1:c84::17",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T04:04:30.142288+00:00",
        "timestamp": "1778990672",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3ab1ea0b-12e1-4a3f-b9e8-a91a3e0cca5f",
        "value": "103.153.183.126",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T04:43:03.408173+00:00",
        "timestamp": "1778992984",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "491d5c24-8884-4f11-b4f7-d0a935b94063",
        "value": "2001:470:2cc:1::15f",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T05:18:02.709535+00:00",
        "timestamp": "1778995084",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "73a48407-1246-4f12-ae80-021688246a80",
        "value": "43.155.26.193",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T05:30:19.055894+00:00",
        "timestamp": "1778995821",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f33de617-fcb5-4c2c-8ec0-82da14df7b68",
        "value": "74.82.47.5",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T06:12:54.733124+00:00",
        "timestamp": "1778998376",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "90d1f1e6-9b22-4eb6-96d2-c9c1bcfc430c",
        "value": "43.165.65.117",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T06:13:42.789996+00:00",
        "timestamp": "1778998425",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "861a56e1-8696-47c3-b744-a1477eae9ec4",
        "value": "43.157.62.101",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T07:17:48.459931+00:00",
        "timestamp": "1779002270",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2bfcaeb1-14fa-47ac-a583-824062654abd",
        "value": "23.27.75.98",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T07:36:21.604358+00:00",
        "timestamp": "1779003383",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cac281d8-83b6-4be4-a793-e91c502a7a30",
        "value": "216.40.79.35",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T08:00:50.246261+00:00",
        "timestamp": "1779004851",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c6d88645-e9d4-4bac-8fe7-f8bf1d4101b2",
        "value": "43.164.129.191",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T10:04:58.109302+00:00",
        "timestamp": "1779012300",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d2177c02-9914-4c3c-a8e9-b0d3efe42071",
        "value": "43.165.7.132",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T10:14:03.226725+00:00",
        "timestamp": "1779012845",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a6ca72d2-75f2-4f6f-97d5-3174c26456b6",
        "value": "43.155.162.41",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T10:15:50.544687+00:00",
        "timestamp": "1779012952",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b21b8543-31c4-4471-b5b4-3a3f17d31a4c",
        "value": "43.156.232.190",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T12:37:58.831409+00:00",
        "timestamp": "1779021480",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "787f13c1-29c2-4433-b8a4-dfac866d1d76",
        "value": "34.51.162.188",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:06:18.012118+00:00",
        "timestamp": "1779023179",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "391bb645-ff72-44be-b9f7-5cb9637a1d49",
        "value": "34.51.209.174",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:32:06.681424+00:00",
        "timestamp": "1779024728",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4ab6c7ef-a408-4453-85b0-5b3a6b780700",
        "value": "129.226.174.80",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:41:02.474188+00:00",
        "timestamp": "1779025264",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "40bd822e-e0c0-46e9-a4c8-f27f518a68e4",
        "value": "3.139.62.64",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:41:17.994108+00:00",
        "timestamp": "1779025280",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "97252269-6db1-4b76-8640-2c985c1c4a2c",
        "value": "43.165.186.188",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:46:17.903268+00:00",
        "timestamp": "1779025580",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b331ce68-a59b-4f08-93e0-fb2ad67ccd17",
        "value": "43.161.251.162",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T13:48:34.863124+00:00",
        "timestamp": "1779025716",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2e28b990-5f23-4751-a6ce-a93829396a20",
        "value": "43.162.95.192",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T17:29:17.739701+00:00",
        "timestamp": "1779038960",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "edde19ea-118f-4f01-a8f7-0ffeb52dfa7f",
        "value": "101.32.52.164",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T17:36:19.527496+00:00",
        "timestamp": "1779039381",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c105eaa1-eb38-45a0-a9d2-c06ad3ec704f",
        "value": "43.162.114.69",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T20:24:36.038749+00:00",
        "timestamp": "1779049477",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b35a9d9c-b15d-4532-9168-a29589045d30",
        "value": "104.164.131.191",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T21:20:39.540148+00:00",
        "timestamp": "1779052841",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "fa999d24-bb52-4301-8569-650bb62422d2",
        "value": "155.254.34.242",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T21:44:21.766541+00:00",
        "timestamp": "1779054264",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "40a98cc5-f62d-4a3a-bbc4-5e1d7574b2c4",
        "value": "43.157.98.187",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-05-17T21:52:06.602636+00:00",
        "timestamp": "1779054729",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a22454b7-69ad-4170-b73c-4064ba06b042",
        "value": "119.28.89.249",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}