{"valid":true,"found":true,"anonymizedPreview":false,"noindex":false,"ipAddress":"138.124.242.51","identifiedIncidents":0,"indicator":{"id":"cmqa9gtug03m1pbpvbww3gbop","value":"138.124.242.51","publicSlug":"ip/138.124.242.51","verdict":"threat actor or compromised host","threatLevel":"HIGH","confidence":85,"status":"ACTIVE","suggestedAction":"Temporary Block","firstSeenAt":"2026-06-12T01:41:54.328Z","lastSeenAt":"2026-06-20T18:11:44.913Z","recentWindow":"9 days","countryCode":null,"countryName":null,"asn":null,"organization":null,"sourceCount":138,"tenantCount":1,"summary":"Source interacted with a Sotiras honeypot decoy. Any contact with a decoy that advertises no legitimate service is unsolicited and treated as malicious.","correctionNote":null,"reviewAfter":"2026-07-04T18:11:44.913Z"},"sourceMix":["HONEYPOT"],"behaviorCategories":["active-aggressors"],"confidenceReasons":["High confidence score from approved Sotiras evidence.","Seen across 138 approved source records.","Behavior includes active-aggressors.","Suggested action is Temporary Block.","High threat level after scoring."],"sharedNetwork":{"classification":"unknown","label":"Unknown shared-network context","likelihood":"LOW","score":15,"reasons":["Observed across 138 source records.","Sotiras has observation evidence, but not enough network context to classify this as shared infrastructure."],"recommendedResponse":"Observe, enrich, and collect more tenant evidence before taking enforcement action.","caveat":"Shared-network classification shapes response; tenant-observed behavior still drives enforcement."},"scores":{"aggressiveness":100,"backgroundNoise":70},"activityTimeline":[{"date":"2026-06-12","observations":92},{"date":"2026-06-20","observations":46}],"blocklists":[{"key":"active-aggressors","label":"Active aggressors"}],"topSources":[{"label":"Honeypot","count":138}],"topEvents":[{"label":"HTTP probing","count":123},{"label":"Honeypot Http Interaction","count":12},{"label":"Honeypot Fake Login","count":3}],"topPorts":[{"label":"80/tcp","count":138}],"topSourceCountries":[],"targetedServices":[{"label":"web-route-trap","count":138}],"subnet":{"cidr":"138.124.242.0/24","relatedPublishedIndicators":1}}