UnknownPublished 18 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-18

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

KRVTZ-NET IDS alerts for 2026-04-18

Impact

The impact is limited to network reconnaissance detected by IDS sensors. There is no evidence of exploitation, compromise, or active threats beyond scanning activity. While such reconnaissance may be used by threat actors for information gathering, it does not itself constitute a direct vulnerability or active attack.

Defensive guidance

Standard network monitoring and IDS alerting remain appropriate. No urgent or additional actions are indicated by the vendor or source.

Summary

On April 18, 2026, KRVTZ-NET IDS detected low-severity reconnaissance activity characterized by network scans and web crawling from several IP addresses. The indicators include IPs linked to TGI HUNT curl requests, LeakIX inbound user-agent scans, and Naver Webcrawler user-agent scans. No CVE identifiers or known exploits are associated with this event. No affected software versions or patches are reported. The activity is classified as OSINT and network reconnaissance without evidence of exploitation or compromise.

Indicators of compromise

IP addresses 5

47.245.138.228TGI HUNT Curl to Bare IP Address
2a03:b0c0:1:d0::c6d:c001ET SCAN LeakIX Inbound User-Agent
2604:a880:800:10::904:4001ET SCAN LeakIX Inbound User-Agent
125.209.235.184ET SCAN Naver Webcrawler User-Agent (Naver.me)
211.249.46.68ET SCAN Naver Webcrawler User-Agent (Naver.me)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:23 UTC

Indicators of compromise

IP addresses 5

Community reviews

Related threats