{"valid":true,"found":true,"anonymizedPreview":false,"noindex":false,"ipAddress":"93.174.93.12","identifiedIncidents":0,"indicator":{"id":"cmpsfpelt01e6n1pvr08vymya","value":"93.174.93.12","publicSlug":"ip/93.174.93.12","verdict":"threat actor or compromised host","threatLevel":"HIGH","confidence":85,"status":"ACTIVE","suggestedAction":"Temporary Block","firstSeenAt":"2026-05-30T14:16:41.009Z","lastSeenAt":"2026-06-20T18:16:00.726Z","recentWindow":"21 days","countryCode":null,"countryName":null,"asn":null,"organization":null,"sourceCount":123,"tenantCount":1,"summary":"Source interacted with a Sotiras honeypot decoy. Any contact with a decoy that advertises no legitimate service is unsolicited and treated as malicious.","correctionNote":null,"reviewAfter":"2026-07-04T18:16:00.726Z"},"sourceMix":["HONEYPOT"],"behaviorCategories":["active-aggressors"],"confidenceReasons":["High confidence score from approved Sotiras evidence.","Seen across 123 approved source records.","Behavior includes active-aggressors.","Suggested action is Temporary Block.","High threat level after scoring."],"sharedNetwork":{"classification":"unknown","label":"Unknown shared-network context","likelihood":"LOW","score":15,"reasons":["Observed across 123 source records.","Sotiras has observation evidence, but not enough network context to classify this as shared infrastructure."],"recommendedResponse":"Observe, enrich, and collect more tenant evidence before taking enforcement action.","caveat":"Shared-network classification shapes response; tenant-observed behavior still drives enforcement."},"scores":{"aggressiveness":100,"backgroundNoise":70},"activityTimeline":[{"date":"2026-05-30","observations":1},{"date":"2026-05-31","observations":8},{"date":"2026-06-01","observations":7},{"date":"2026-06-02","observations":4},{"date":"2026-06-03","observations":4},{"date":"2026-06-04","observations":8},{"date":"2026-06-05","observations":7},{"date":"2026-06-06","observations":5},{"date":"2026-06-07","observations":5},{"date":"2026-06-08","observations":7},{"date":"2026-06-09","observations":6},{"date":"2026-06-10","observations":4},{"date":"2026-06-11","observations":8},{"date":"2026-06-12","observations":5},{"date":"2026-06-13","observations":7},{"date":"2026-06-14","observations":5},{"date":"2026-06-15","observations":6},{"date":"2026-06-16","observations":6},{"date":"2026-06-17","observations":6},{"date":"2026-06-18","observations":4},{"date":"2026-06-19","observations":6},{"date":"2026-06-20","observations":4}],"blocklists":[{"key":"active-aggressors","label":"Active aggressors"}],"topSources":[{"label":"Honeypot","count":123}],"topEvents":[{"label":"Honeypot Fake Login","count":63},{"label":"HTTP probing","count":60}],"topPorts":[{"label":"80/tcp","count":123}],"topSourceCountries":[],"targetedServices":[{"label":"fake-login","count":63},{"label":"web-route-trap","count":60}],"subnet":{"cidr":"93.174.93.0/24","relatedPublishedIndicators":1}}