{
  "Event": {
    "analysis": "1",
    "date": "2026-07-27",
    "extends_uuid": "",
    "info": "[Threat Intel] Technical Advisory: wp2shell \u2014 Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core",
    "protected": false,
    "publish_timestamp": "1785616370",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785616370",
    "uuid": "62135393-b272-41d4-956b-dcd6acdf6c57",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#44212b",
        "local": false,
        "name": "misp-galaxy:producer=\"Bitdefender\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#9edfba",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Malware - T1587.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerabilities - T1588.006\"",
        "relationship_type": ""
      },
      {
        "colour": "#7d7034",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#fe1ef0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0aebeb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bd28",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "relationship_type": ""
      },
      {
        "colour": "#4c0fbb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "relationship_type": ""
      },
      {
        "colour": "#fae37b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:software-vendor=\"WordPress\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236413",
        "to_ids": false,
        "type": "link",
        "uuid": "338fde02-d56a-4558-9526-661db59515da",
        "value": "https://businessinsights.bitdefender.com/technical-advisory-wp2shell-unauthenticated-remote-code-execution-full-site-takeover-wordpress-core"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236413",
        "to_ids": false,
        "type": "text",
        "uuid": "c84cce8d-b197-49e4-8fa7-c2b2c1aacc89",
        "value": "Two chained vulnerabilities in WordPress Core enable unauthenticated remote code execution on installations running versions 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1. The first flaw affects the REST API batch endpoint validation, while the second is a SQL injection in the post query layer. When exploited together, attackers achieve full administrator access and deploy webshells. Active exploitation has been confirmed with a public proof-of-concept available. Attackers conduct mass scanning followed by automated compromise sequences that create unauthorized administrator accounts with w2s_ prefixes, upload malicious plugins, and establish persistent remote access. Observed incidents show multiple exploitation attempts before successful compromise. Fixed versions 6.9.5 and 7.0.2 are available, with forced auto-updates deployed. Organizations should patch immediately or implement WAF rules blocking anonymous access to the batch endpoint."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236413",
        "to_ids": false,
        "type": "text",
        "uuid": "5b72b5c1-edeb-4595-9c7b-a207005d7ca2",
        "value": "Name: Technical Advisory: wp2shell \u2014 Unauthenticated Remote Code Execution and Full Site Takeover in WordPress Core\nAuthor: AlienVault\nAdversary: \nTags: [\"cve-2026-60137\", \"sql injection\", \"wordpress\", \"webshell\", \"cve-2026-63030\", \"batch endpoint\", \"rest api\", \"remote code execution\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1587.001\", \"T1588.006\", \"T1082\", \"T1140\", \"T1190\", \"T1595.002\", \"T1505.003\", \"T1136.001\", \"T1059\", \"T1083\", \"T1059.004\", \"T1203\", \"T1071.001\", \"T1046\", \"T1105\", \"T1569.002\", \"T1078.003\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236413",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "d77d0aab-3e14-4761-91c3-e6667f0228c8",
        "value": "CVE-2026-63030"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785236413",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "b6bf212c-b545-4b0f-88fd-104ba504b254",
        "value": "CVE-2026-60137"
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600950",
        "to_ids": true,
        "type": "sha256",
        "uuid": "43dc692e-1eac-4ead-845d-0bddb12c74cd",
        "value": "12de8ce21bc534a968c327c00f2aa933b9034bc39b367ad1659f5aaa8be07744",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600951",
        "to_ids": true,
        "type": "sha256",
        "uuid": "284f32d2-8f43-4758-8965-0901093858d1",
        "value": "37d86716edcb5b481d5d34b38b3bb4b522fcabdf0baf9b0523a0a61957620fad",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600952",
        "to_ids": true,
        "type": "sha256",
        "uuid": "605c88d3-a1d8-47d6-829c-b02625412f2f",
        "value": "4f4dc354dfa3ab9df33107b02106424d9940119363ceaff3399aefa8b14859dc",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600953",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7040c58b-c484-4753-b19b-d13ee81ddad8",
        "value": "5588eb0d473bbc104ecb7d41037a747280eba03956a3d4c11368e4f0bd427ead",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600955",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b580bf71-6f09-45ed-a8d3-09b538bac137",
        "value": "67ce5c125611078c2a6294faacd378b7dccbfb490641a0ca0822b071a22f759c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600956",
        "to_ids": true,
        "type": "sha256",
        "uuid": "0b9aa660-6cb7-4c5e-bb58-2c4bf28f4928",
        "value": "9c1bf6681ca94ab703d4f393fbfdd0acfb081285cd47ea4cf718ff9b71835722",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600957",
        "to_ids": true,
        "type": "sha256",
        "uuid": "a31104a1-1ea6-48cc-a30e-d9b74c94c339",
        "value": "d3e34d9306106aca15b1deb6dcfbe169c5f0df470bd22095845d553a60cbfd1e",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600958",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7bc8572e-3046-410c-9481-3ea750af710e",
        "value": "d4cf7b5d8722236de52e9bad855b4ed4d99f18a561d192aec33525ec89557a7c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600959",
        "to_ids": true,
        "type": "sha256",
        "uuid": "21db4bc7-4610-4e7c-9198-2fffa4fffe3f",
        "value": "d8dfdab3a4358dbcd0eb129494d9e64b8392ef564bdc4cbe73e238c6d3ba51cd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "No sample in VT\r\nLast check: 02/08/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785600960",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6268fb2c-4b1e-43e6-91a0-39a48e4e5b31",
        "value": "ee8395666b9367967749757da27784922fdc18dc3e85db864d30fa703eb9db18",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603251",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5cfc8873-5a83-46d0-8ae3-00b854c1983b",
        "value": "80.82.65.226",
        "Tag": [
          {
            "colour": "#55c66b",
            "local": false,
            "name": "asn:asn=\"202425\"",
            "relationship_type": ""
          },
          {
            "colour": "#a647be",
            "local": false,
            "name": "asn:as-owner=\"INT-NETWORK\"",
            "relationship_type": ""
          },
          {
            "colour": "#b0962c",
            "local": false,
            "name": "asn:as-country=\"SC\"",
            "relationship_type": ""
          },
          {
            "colour": "#85ff13",
            "local": false,
            "name": "misp-galaxy:country=\"seychelles\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603272",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "fb7093d6-549f-41ff-9c02-efc4006d059e",
        "value": "35.192.232.168",
        "Tag": [
          {
            "colour": "#661a1f",
            "local": false,
            "name": "asn:asn=\"396982\"",
            "relationship_type": ""
          },
          {
            "colour": "#b21243",
            "local": false,
            "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603293",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "140d31b1-ed79-4d38-ba9a-9872974d4ea1",
        "value": "34.31.88.250",
        "Tag": [
          {
            "colour": "#661a1f",
            "local": false,
            "name": "asn:asn=\"396982\"",
            "relationship_type": ""
          },
          {
            "colour": "#b21243",
            "local": false,
            "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603315",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "6ce3a8a7-7ec3-4f30-9ddd-c80ed7b49a3f",
        "value": "52.173.161.248",
        "Tag": [
          {
            "colour": "#4d7cde",
            "local": false,
            "name": "asn:asn=\"8075\"",
            "relationship_type": ""
          },
          {
            "colour": "#61ef58",
            "local": false,
            "name": "asn:as-owner=\"MICROSOFT-CORP-MSN-AS-BLOCK\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785603336",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "aa227419-81cc-4593-8002-01ce040c65dc",
        "value": "18.157.122.248",
        "Tag": [
          {
            "colour": "#4745f2",
            "local": false,
            "name": "asn:asn=\"16509\"",
            "relationship_type": ""
          },
          {
            "colour": "#5424ef",
            "local": false,
            "name": "asn:as-owner=\"AMAZON-02\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}