diff --git a/frontend/src/components/IncidentsView.tsx b/frontend/src/components/IncidentsView.tsx
index 83eb2b1..8674a16 100644
--- a/frontend/src/components/IncidentsView.tsx
+++ b/frontend/src/components/IncidentsView.tsx
@@ -106,6 +106,12 @@ export function IncidentsView() {
     return code.toUpperCase().replace(/./g, char => String.fromCodePoint(char.charCodeAt(0) + 127397));
   };
 
+  // Nettoyer une adresse IP (enlever ::ffff: prefix)
+  const cleanIP = (address: string): string => {
+    if (!address) return '';
+    return address.replace(/^::ffff:/i, '');
+  };
+
   if (loading) {
     return (
       <div className="flex items-center justify-center h-64">
@@ -249,7 +255,7 @@ export function IncidentsView() {
                       </span>
                       <span className="text-lg font-bold text-text-primary">{cluster.id}</span>
                       <span className="text-text-secondary">|</span>
-                      <span className="font-mono text-sm text-text-primary">{cluster.subnet}</span>
+                      <span className="font-mono text-sm text-text-primary">{cleanIP(cluster.subnet || '')}</span>
                     </div>
                     <div className="flex items-center gap-4">
                       <div className="text-right">
@@ -303,13 +309,13 @@ export function IncidentsView() {
 
                   <div className="flex gap-2">
                     <button
-                      onClick={() => navigate(`/investigation/${cluster.subnet?.split('/')[0] || ''}`)}
+                      onClick={() => navigate(`/investigation/${cleanIP(cluster.subnet?.split('/')[0] || '')}`)}
                       className="px-3 py-1.5 bg-accent-primary text-white rounded text-sm hover:bg-accent-primary/80 transition-colors"
                     >
                       Investiguer
                     </button>
                     <button
-                      onClick={() => navigate(`/entities/ip/${cluster.subnet?.split('/')[0] || ''}`)}
+                      onClick={() => navigate(`/entities/ip/${cleanIP(cluster.subnet?.split('/')[0] || '')}`)}
                       className="px-3 py-1.5 bg-background-card text-text-primary rounded text-sm hover:bg-background-card/80 transition-colors"
                     >
                       Voir détails
@@ -317,7 +323,7 @@ export function IncidentsView() {
                     <button
                       onClick={() => {
                         // Quick classify
-                        navigate(`/bulk-classify?ips=${encodeURIComponent(cluster.subnet?.split('/')[0] || '')}`);
+                        navigate(`/bulk-classify?ips=${encodeURIComponent(cleanIP(cluster.subnet?.split('/')[0] || ''))}`);
                       }}
                       className="px-3 py-1.5 bg-background-card text-text-primary rounded text-sm hover:bg-background-card/80 transition-colors"
                     >
@@ -332,7 +338,7 @@ export function IncidentsView() {
                           objects: [{
                             type: 'indicator',
                             id: `indicator--${cluster.id}`,
-                            pattern: `[ipv4-addr:value = '${cluster.subnet?.split('/')[0]}'`,
+                            pattern: `[ipv4-addr:value = '${cleanIP(cluster.subnet?.split('/')[0] || '')}'`,
                             pattern_type: 'stix'
                           }]
                         };
@@ -396,7 +402,7 @@ export function IncidentsView() {
                 >
                   <td className="px-4 py-3 text-text-secondary">{index + 1}</td>
                   <td className="px-4 py-3 font-mono text-sm text-text-primary">
-                    {cluster.subnet?.split('/')[0] || 'Unknown'}
+                    {cleanIP(cluster.subnet?.split('/')[0] || 'Unknown')}
                   </td>
                   <td className="px-4 py-3 text-sm text-text-secondary">IP</td>
                   <td className="px-4 py-3">