Mmastodon TechnologyCybersecurity first seen 3 h ago, last 3 h ago, peak #3
GreyNoise flags malicious IPs in live Entra ID demo
Original: During a live product demo, GreyNoise-labeled malicious IPs were identified in an organization’s Entra ID sign-in logs.
During a live product demonstration, security company GreyNoise identified IP addresses it labels as malicious inside an organization's Microsoft Entra ID sign-in logs. The addresses looked benign at first glance, appearing residential and matching expected geolocations. The tell was multiple users authenticating from the same IP address, a pattern inconsistent with normal user behavior and a signal of potential compromise.
Why now: The finding shows how attackers increasingly use residential proxies to blend into normal traffic, prompting security teams to reassess how they evaluate risky sign-ins.
Evidence
- During a live product demo, GreyNoise-labeled malicious IPs were identified in an organization’s Entra ID sign-in logs. The IPs appeared normal on the surface, residential and the right geolocation. Until multiple users were authenticating from the same IP address. That… · greynoise@infosec.exchange · 1
API: https://socialmediatrends-api.osmike.com/v1/trends/2362709