diff --git a/security/security-threat-intelligence-analyst.md b/security/security-threat-intelligence-analyst.md
index 758e3e21..5465d5c4 100644
--- a/security/security-threat-intelligence-analyst.md
+++ b/security/security-threat-intelligence-analyst.md
@@ -493,16 +493,16 @@ class IOCEnrichmentPipeline:
         results = []
 
         for raw in raw_indicators:
-            ioc_type = self.classifier.classify(raw)
+            value = raw.strip()
+            ioc_type = self.classifier.classify(value)
             if ioc_type is None:
                 continue  # Skip unrecognized indicators
 
             # Skip private IPs
             if ioc_type in (IOCType.IPV4, IOCType.IPV6):
-                if self.classifier.is_private_ip(raw):
+                if self.classifier.is_private_ip(value):
                     continue
 
-            value = raw.strip()
             if ioc_type != IOCType.URL:
                 value = value.lower()