{"valid":true,"found":true,"anonymizedPreview":false,"noindex":false,"ipAddress":"204.76.203.206","identifiedIncidents":0,"indicator":{"id":"cmq43645a0qgfk5pv1fl2r36f","value":"204.76.203.206","publicSlug":"ip/204.76.203.206","verdict":"threat actor or compromised host","threatLevel":"HIGH","confidence":85,"status":"ACTIVE","suggestedAction":"Temporary Block","firstSeenAt":"2026-06-07T17:58:59.710Z","lastSeenAt":"2026-06-20T18:16:25.729Z","recentWindow":"13 days","countryCode":null,"countryName":null,"asn":null,"organization":null,"sourceCount":644,"tenantCount":1,"summary":"Source interacted with a Sotiras honeypot decoy. Any contact with a decoy that advertises no legitimate service is unsolicited and treated as malicious.","correctionNote":null,"reviewAfter":"2026-07-04T18:16:25.729Z"},"sourceMix":["HONEYPOT"],"behaviorCategories":["active-aggressors"],"confidenceReasons":["High confidence score from approved Sotiras evidence.","Seen across 644 approved source records.","Behavior includes active-aggressors.","Suggested action is Temporary Block.","High threat level after scoring."],"sharedNetwork":{"classification":"unknown","label":"Unknown shared-network context","likelihood":"LOW","score":20,"reasons":["Observed across 644 source records.","Nearby IPs in the same IPv4 /24 have 5 related published indicators.","Sotiras has observation evidence, but not enough network context to classify this as shared infrastructure."],"recommendedResponse":"Observe, enrich, and collect more tenant evidence before taking enforcement action.","caveat":"Shared-network classification shapes response; tenant-observed behavior still drives enforcement."},"scores":{"aggressiveness":100,"backgroundNoise":70},"activityTimeline":[{"date":"2026-06-15","observations":44},{"date":"2026-06-16","observations":46},{"date":"2026-06-17","observations":44},{"date":"2026-06-18","observations":39},{"date":"2026-06-19","observations":42},{"date":"2026-06-20","observations":35}],"blocklists":[{"key":"active-aggressors","label":"Active aggressors"}],"topSources":[{"label":"Honeypot","count":644}],"topEvents":[{"label":"Honeypot Fake Login","count":323},{"label":"HTTP probing","count":321}],"topPorts":[{"label":"80/tcp","count":644}],"topSourceCountries":[],"targetedServices":[{"label":"web-route-trap","count":125},{"label":"fake-login","count":125}],"subnet":{"cidr":"204.76.203.0/24","relatedPublishedIndicators":5}}