{
  "Event": {
    "analysis": "1",
    "date": "2026-02-22",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-22",
    "publish_timestamp": "1771803409",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771803216",
    "uuid": "fd861729-2897-4cd2-a2d4-c7918f649e75",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T00:12:44.056162+00:00",
        "timestamp": "1771719166",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0167c2ec-d171-406c-98bb-01d6893b9888",
        "value": "52.224.244.230",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T01:14:10.374502+00:00",
        "timestamp": "1771722852",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bab349d2-bf0a-40e3-aead-7daa312b51bd",
        "value": "162.240.14.171",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T01:40:53.292137+00:00",
        "timestamp": "1771724455",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "fadb01ea-324a-4080-a1d4-d36f1723c45a",
        "value": "91.185.189.19",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T06:12:36.432894+00:00",
        "timestamp": "1771740758",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b0686f05-e9f2-43b1-b74d-7476e384efb5",
        "value": "2001:470:1:c84::27",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T06:49:41.096394+00:00",
        "timestamp": "1771742982",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f6df679b-6f64-41e3-9b32-84a4d5da919c",
        "value": "170.64.146.88",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T10:19:45.991560+00:00",
        "timestamp": "1771755587",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "69d41426-9be4-42b1-aa22-663d69a64c1c",
        "value": "2002:67b2:afb4::67b2:afb4",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS React Server Components React2Shell Unsafe Flight Protocol Property Access (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T17:21:31.260574+00:00",
        "timestamp": "1771780892",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b2149966-851b-4616-ac94-0b0e69c291af",
        "value": "98.159.36.151",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T20:25:55.220383+00:00",
        "timestamp": "1771791956",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "25a8e83b-8124-49ad-9e33-dc5d053d2454",
        "value": "18.234.175.242",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T20:25:59.769082+00:00",
        "timestamp": "1771791961",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "19062d0e-e2f6-4a8f-ae57-262837004d5f",
        "value": "52.221.240.184",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "haproxy: 95.111.250.145 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T20:26:07.680859+00:00",
        "timestamp": "1771791969",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c2d24255-b9c7-4ba9-ae28-0137c545b47f",
        "value": "95.111.250.145",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T20:26:28.530407+00:00",
        "timestamp": "1771791990",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "5cd6c187-d910-48e1-9e8c-eb7bfa43b0ea",
        "value": "175.126.146.174",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-22T23:33:34.289762+00:00",
        "timestamp": "1771803216",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cfd55433-93fc-45f2-8796-550120bfcd88",
        "value": "195.178.110.160",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}