{
  "Event": {
    "analysis": "1",
    "date": "2026-02-17",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-17",
    "publish_timestamp": "1771372077",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771372076",
    "uuid": "eea9862d-1281-44d9-8657-f9e1ff0838f8",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:13.060076+00:00",
        "timestamp": "1771288154",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e65a3a15-83fd-4019-90cc-378ce596bf70",
        "value": "206.189.19.19",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:16.965574+00:00",
        "timestamp": "1771288158",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a77237f5-70eb-4717-998b-4c7bbfb144a0",
        "value": "134.209.25.199",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:21.889131+00:00",
        "timestamp": "1771288163",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "114a10da-cc72-4cf7-8cef-d699f80f1599",
        "value": "209.97.132.108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:26.221308+00:00",
        "timestamp": "1771288167",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8010613b-3231-4ee3-ae36-4e47cde74394",
        "value": "172.232.216.141",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:30.370769+00:00",
        "timestamp": "1771288172",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "db7b87f1-868c-4645-910b-78cfcd14b856",
        "value": "164.92.78.36",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:36.882973+00:00",
        "timestamp": "1771288178",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "df30fbaf-4268-44e0-bf07-ba88de527769",
        "value": "206.189.68.158",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:40.769389+00:00",
        "timestamp": "1771288182",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "822adddc-d001-4bbe-81b4-d38df506ebe7",
        "value": "157.245.105.107",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT HTTP POST to wp-.* Path Without Referer",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:29:44.843181+00:00",
        "timestamp": "1771288186",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "202e7802-4edd-402e-a242-b8b3f8822c40",
        "value": "45.156.87.52",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:30:56.541823+00:00",
        "timestamp": "1771288258",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7cf7546c-ae27-43f2-8693-5db6e4e1a7fd",
        "value": "157.245.113.227",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:31:00.267567+00:00",
        "timestamp": "1771288261",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a9b7c022-4bed-498b-8e6c-db76953ddfb1",
        "value": "146.190.63.248",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:31:03.852303+00:00",
        "timestamp": "1771288265",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5962e818-2fcc-4bfd-bf18-2e051c25e362",
        "value": "64.227.55.17",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:33:20.636377+00:00",
        "timestamp": "1771288402",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1d24082e-2e57-4fc9-9026-6823aec976b3",
        "value": "46.101.247.114",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:33:24.268145+00:00",
        "timestamp": "1771288405",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b8b6703f-16b3-46aa-a480-6d9efde2574c",
        "value": "192.46.221.38",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T00:53:00.274778+00:00",
        "timestamp": "1771289582",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "17f991c6-2c38-46af-8621-75d0db58701c",
        "value": "56.228.17.108",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET MALWARE SysJoker User-Agent Observed",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T01:52:14.632871+00:00",
        "timestamp": "1771293136",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a00b0270-8bfa-4317-852d-f715570c3ecf",
        "value": "103.98.212.250",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T01:59:07.625523+00:00",
        "timestamp": "1771293549",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "515eac4a-814b-4805-8ba2-f1bc1f8540e9",
        "value": "45.148.10.64",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T03:46:02.567195+00:00",
        "timestamp": "1771299964",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "28954206-2239-45e5-ae43-b0936ab1fded",
        "value": "2a02:c207:2308:3006::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T05:20:18.222604+00:00",
        "timestamp": "1771305620",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "dfda1864-b174-42e6-b250-a2b13791fa86",
        "value": "2001:470:1:332::3",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T13:46:33.853591+00:00",
        "timestamp": "1771335995",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "99947dde-4e1a-4262-82a3-606ba0e6fb15",
        "value": "134.33.138.166",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:06:20.871041+00:00",
        "timestamp": "1771340782",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5166afde-d2db-48c5-8cae-c297edcb5af3",
        "value": "129.212.181.87",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:06:40.860885+00:00",
        "timestamp": "1771340802",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e6f7da6c-1878-44ab-b4f7-72ce50e0568c",
        "value": "43.156.30.194",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:09:13.169859+00:00",
        "timestamp": "1771340954",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4d2eb3a0-cf08-4635-b010-68b1a0d56512",
        "value": "103.253.146.114",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:09:29.458814+00:00",
        "timestamp": "1771340971",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "655869c6-07f8-4b3f-a5a5-618e48610bdf",
        "value": "118.145.192.109",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:39:32.997091+00:00",
        "timestamp": "1771342774",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c7e3e839-c46d-452d-9552-c9f40fe90b3e",
        "value": "24.199.88.91",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T15:39:55.645180+00:00",
        "timestamp": "1771342797",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5e3b0631-b754-4a99-8a90-e6e039860bf2",
        "value": "157.245.87.34",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T17:35:12.199307+00:00",
        "timestamp": "1771349713",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "189bad08-0041-4604-b802-ee84133dc391",
        "value": "101.79.8.144",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T17:35:48.533697+00:00",
        "timestamp": "1771349750",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2d247b70-e1ef-4f8a-9480-ae4d0e661c6c",
        "value": "61.28.236.154",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T17:51:30.429553+00:00",
        "timestamp": "1771350692",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3cd68d5d-5863-4df6-ad48-66fd2149ef65",
        "value": "147.182.182.80",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T17:52:10.409033+00:00",
        "timestamp": "1771350732",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e7d40a90-b4f2-43b0-b3d0-2c57617a8591",
        "value": "47.236.224.219",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:07:14.811317+00:00",
        "timestamp": "1771351636",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "057f77e2-012d-4cc4-87bb-1ce66a2affd4",
        "value": "13.216.15.75",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:07:51.335976+00:00",
        "timestamp": "1771351672",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9865260d-d57a-453d-80c2-b3cc203e11bb",
        "value": "137.184.129.134",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:09:32.520585+00:00",
        "timestamp": "1771351774",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8896b3e5-6257-42da-97a1-b329fe3cc592",
        "value": "61.28.236.148",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:14:15.533998+00:00",
        "timestamp": "1771352057",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8f540069-5522-4d2f-a4db-e7c2cdae6b29",
        "value": "163.176.182.253",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:24:07.750656+00:00",
        "timestamp": "1771352649",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bf7cbf32-fbc5-4f7e-af63-a363f1516a77",
        "value": "162.43.52.38",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:24:35.255842+00:00",
        "timestamp": "1771352676",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7044b561-37f9-47d5-9e6b-296a5f6c06e8",
        "value": "116.237.35.30",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:25:11.337136+00:00",
        "timestamp": "1771352713",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d5165e49-557e-4e6d-9cbc-a713d5a043cc",
        "value": "34.171.24.229",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T18:32:27.799472+00:00",
        "timestamp": "1771353149",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "08f783f6-7f63-4937-9764-65f79903f885",
        "value": "121.40.46.247",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T21:52:34.491200+00:00",
        "timestamp": "1771365156",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3f07e844-36eb-4db8-bf69-a5c19a887151",
        "value": "31.97.167.213",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T22:33:25.613285+00:00",
        "timestamp": "1771367607",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cd8649a4-3378-44e6-b902-d02a519feba1",
        "value": "45.148.10.79",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T23:01:32.324621+00:00",
        "timestamp": "1771369293",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9d8d0874-5a75-4e5c-be2f-dc471e2ffd68",
        "value": "193.42.61.105",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET MALWARE Suspicious User-Agent (WindowsNT) With No Separating Space",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-17T23:47:55.253028+00:00",
        "timestamp": "1771372076",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ff3639b8-b802-49e2-8f33-51dce453ad62",
        "value": "83.229.112.136",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}