UnknownPublished 7 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-07

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2011-5148

Description

KRVTZ-NET IDS alerts for 2026-04-07

Impact

The impact is limited to detection of reconnaissance and scanning activities without confirmed exploitation or compromise. These activities may represent preparatory steps for potential future attacks but do not indicate an immediate threat or active breach. No known exploits or ransomware campaigns are associated with these alerts.

Defensive guidance

No specific patch or remediation is available or required since this report describes observed network activity rather than a vulnerability. Security teams should maintain existing protections against brute force and scanning attempts and continue monitoring for suspicious activity. No urgent action is indicated based on this data.

Indicators of compromise

IP addresses 9

2a02:c207:2315:7388::1ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)
110.93.150.31ET SCAN Naver Webcrawler User-Agent (Naver.me)
211.249.46.66ET SCAN Naver Webcrawler User-Agent (Naver.me)
34.6.109.61ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan
211.249.46.42ET SCAN Naver Webcrawler User-Agent (Naver.me)
103.8.27.27ET INFO Request to Hidden Environment File - Inbound
123.58.200.147haproxy: 123.58.200.147 connecting to (submission/TCP) 15x in hour, possible bruteforcing.
208.77.244.162ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan
20.200.222.0ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 02:21 UTC

Indicators of compromise

IP addresses 9

Community reviews

Related threats