Anonymous IP address | joe.lartey@manytek.org | Malicious IP Sweden| Multiple Failures | Password resets | Verifying with Mgr

Summary

On 12/05/2026 18:00:00 EST, the Manytek Security Operation Team (MSOC Team), received an alert title “Anonymous IP address” The alert was triggered when the user “joe.lartey” was detected attempting to sign-in from an anonymous hosting IP provider located in Sweden, Using Firefox browser on windows 10 device.

The IP address “2a0d:bbc7::f816:3eff:fec7:9bc8” is registered to QuxLabs AB located in Sweden and has been reported by OSINT Sources as highly malicious. Sigin-in Logs of the user account activity and IP in the last 7days shows multiple keep me signed in interrupts and repeated failures, followed by successful attempts with no MFA required, all from non cooperate device.

This behavior differs from the users normal pattern. Joe normally sign-ins from Virginia US, using Chrome windows 10 device, with no history of Sweden based access or anonymous IP usage.

Recent Account activity includes a password reset {credential rotation} and a new device registration within the last 7days.

Given the anonymous IP, Foreign location, repeated failures and deviation from the users normal sign-in behavior, the activity is considered suspicious. The MSOC Team is reaching to the users manager to verify if the activity is expected.

2: Given the anonymous IP, Foreign location, repeated failures and deviation from the users normal sign-in behavior, the activity is considered suspicious. The MSOC Team is force reseting the users password and revoking all MFA session and Notify Manager.

Alert Details:

Alert Date/Time: 12/05/2026 18:00:00 EST
Event Date/Time: 11/5/2026 19:16:20 EST
User name: joe.lartey
IP address: 2a0d:bbc7::f816:3eff:fec7:9bc8
Sign-in location: Solna, Stockholms Lan, SE
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Sign-in request Id: 55dfa23a-a247-416a-895b-da9adf0f6200

User Information
Name:Joe Lartey
Email:joe.lartey@manytek.org
Job Title:Application Engineer
Department:Engineering
Mgr: Derek Atiawu

IP Information:
IP:2a0d:bbc7::f816:3eff:fec7:9bc8
ISP: QuxLabs AB
Domain Name: quxlabs.com
Country Stockholm Sweden
This IP was reported 451 times. Confidence of Abuse is 39%:

Action/Recommendations

1: option
Please verify with the user whether the sign-ins from Sweden were expected
If expected, educate the user to refrain from using third party VPN/Proxy IPs when accessing company resources
If not expected, please reply immediately for us to remediate their account.

2: option
Please verify with the user whether the sign-ins from Sweden were expected
If expected, educate the user to refrain from using third party VPN/Proxy IPs when accessing company resources
For precautionary measures we have reset the users account
please Advise the user to reach out to the service desk to have their account re-instated