diff --git a/modules/security/live-attack-monitor-v2.sh b/modules/security/live-attack-monitor-v2.sh
index 968e5fc..5dad79c 100755
--- a/modules/security/live-attack-monitor-v2.sh
+++ b/modules/security/live-attack-monitor-v2.sh
@@ -2553,12 +2553,12 @@ monitor_network_attacks() {
                                     block_reasons="${block_reasons}${div_reason}"
                                 fi
 
-                                local subnet_bonus=$(calculate_subnet_bonus "$ip")
-                                if [ "$subnet_bonus" -gt 0 ]; then
+                                local subnet_data=$(calculate_subnet_bonus "$ip")
+                                IFS='|' read -r subnet_count subnet_bonus subnet_reason <<< "$subnet_data"
+                                if [ "${subnet_bonus:-0}" -gt 0 ]; then
                                     score=$((score + subnet_bonus))
-                                    local context_reason="SUBNET_ATTACK"
                                     [ -n "$block_reasons" ] && block_reasons="${block_reasons}+" || block_reasons=""
-                                    block_reasons="${block_reasons}${context_reason}"
+                                    block_reasons="${block_reasons}${subnet_reason}"
                                 fi
 
                                 # Detect timing patterns
diff --git a/modules/security/live-attack-monitor.sh b/modules/security/live-attack-monitor.sh
index 968e5fc..5dad79c 100755
--- a/modules/security/live-attack-monitor.sh
+++ b/modules/security/live-attack-monitor.sh
@@ -2553,12 +2553,12 @@ monitor_network_attacks() {
                                     block_reasons="${block_reasons}${div_reason}"
                                 fi
 
-                                local subnet_bonus=$(calculate_subnet_bonus "$ip")
-                                if [ "$subnet_bonus" -gt 0 ]; then
+                                local subnet_data=$(calculate_subnet_bonus "$ip")
+                                IFS='|' read -r subnet_count subnet_bonus subnet_reason <<< "$subnet_data"
+                                if [ "${subnet_bonus:-0}" -gt 0 ]; then
                                     score=$((score + subnet_bonus))
-                                    local context_reason="SUBNET_ATTACK"
                                     [ -n "$block_reasons" ] && block_reasons="${block_reasons}+" || block_reasons=""
-                                    block_reasons="${block_reasons}${context_reason}"
+                                    block_reasons="${block_reasons}${subnet_reason}"
                                 fi
 
                                 # Detect timing patterns