{"valid":true,"found":true,"anonymizedPreview":false,"noindex":false,"ipAddress":"18.116.101.220","identifiedIncidents":2,"indicator":{"id":"cmqhemqoi07y9ltpvz5tyds1c","value":"18.116.101.220","publicSlug":"ip/18.116.101.220","verdict":"threat actor or compromised host","threatLevel":"HIGH","confidence":85,"status":"ACTIVE","suggestedAction":"Temporary Block","firstSeenAt":"2026-06-17T01:40:51.474Z","lastSeenAt":"2026-06-20T18:29:15.209Z","recentWindow":"4 days","countryCode":null,"countryName":null,"asn":null,"organization":null,"sourceCount":45,"tenantCount":1,"summary":"Source interacted with a Sotiras honeypot decoy. Any contact with a decoy that advertises no legitimate service is unsolicited and treated as malicious.","correctionNote":null,"reviewAfter":"2026-07-04T18:29:15.209Z"},"sourceMix":["HONEYPOT"],"behaviorCategories":["active-aggressors"],"confidenceReasons":["Sotiras has identified 2 related incidents tied to this IP in internal evidence.","High confidence score from approved Sotiras evidence.","Seen across 45 approved source records.","Behavior includes active-aggressors.","Suggested action is Temporary Block.","High threat level after scoring."],"sharedNetwork":{"classification":"unknown","label":"Unknown shared-network context","likelihood":"LOW","score":15,"reasons":["Observed across 45 source records.","Sotiras has observation evidence, but not enough network context to classify this as shared infrastructure."],"recommendedResponse":"Observe, enrich, and collect more tenant evidence before taking enforcement action.","caveat":"Shared-network classification shapes response; tenant-observed behavior still drives enforcement."},"scores":{"aggressiveness":100,"backgroundNoise":59},"activityTimeline":[{"date":"2026-06-17","observations":4},{"date":"2026-06-18","observations":28},{"date":"2026-06-20","observations":13}],"blocklists":[{"key":"active-aggressors","label":"Active aggressors"}],"topSources":[{"label":"Honeypot","count":45}],"topEvents":[{"label":"Honeypot Tcp Connect","count":29},{"label":"Honeypot Fake Login","count":8},{"label":"HTTP probing","count":8}],"topPorts":[{"label":"25/tcp","count":29},{"label":"80/tcp","count":16}],"topSourceCountries":[],"targetedServices":[{"label":"tcp-banner","count":29},{"label":"fake-login","count":8},{"label":"web-route-trap","count":8}],"subnet":{"cidr":"18.116.101.0/24","relatedPublishedIndicators":1}}