← Back to IP report

Log Explorer

Fact drill-down for 20.168.0.218

Risk 2 LOW Scope All time All-time facts 28 In-scope 28 Filtered 28 Seen 2025-03-28 → 2026-01-26

Freestyle query (contains)

Time (days, optional)

Page size 25 50 100 200

Apply Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

Annotator (exact) (any) cred — 16 base — 12 Severity (exact) (any) (none) — 20 10 — 8 Label (exact) (any) cred — 16 observed — 12

HTTP facets

Method (exact, case-insensitive) (any) GET — 28 HTTP status (exact) (any) 404 — 28

Snapshot facets

Subnet (exact) (any) 20.168.0.0/24 — 28 ASN (exact) (any) 8075 — 28 Country / Region / City (exact)

(any country) United States — 28 (any region) Arizona — 28

(any city) Phoenix — 28

Org contains (ip_org or as_org_name)

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Start

End

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

cred 16 base 12

Top labels (facts, in-scope)

cred 16 observed 12

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 1 — total 28 rows

← Prev Next →

# 2026-01-26 10:53:07 event 29589066 GET 404 bytes 7122

ann base label observed

Request event observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2026-01-26 10:53:07 event 29589066 GET 404 bytes 7122

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2026-01-26 10:53:07 event 29589066 GET 404 bytes 7122

ann cred label cred

Request Auth endpoint request observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 17:21:16 event 10558533 GET 404 bytes 7897

ann base label observed

Request event observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 17:21:16 event 10558533 GET 404 bytes 7897

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 17:21:16 event 10558533 GET 404 bytes 7897

ann cred label cred

Request Auth endpoint request observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 01:42:04 event 9777744 GET 404 bytes 7897

ann base label observed

Request event observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 01:42:04 event 9777744 GET 404 bytes 7897

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-30 01:42:04 event 9777744 GET 404 bytes 7897

ann cred label cred

Request Auth endpoint request observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-26 11:56:33 event 8894640 GET 404 bytes 7894

ann base label observed

Request event observed

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-22 21:57:16 event 6722833 GET 404 bytes 7899

ann base label observed

Request event observed

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-12 12:04:48 event 6261971 GET 404 bytes 7896

ann base label observed

Request event observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-12 12:04:48 event 6261971 GET 404 bytes 7896

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-12 12:04:48 event 6261971 GET 404 bytes 7896

ann cred label cred

Request Auth endpoint request observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-11 02:05:39 event 5384399 GET 404 bytes 7894

ann base label observed

Request event observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-11 02:05:39 event 5384399 GET 404 bytes 7894

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-11 02:05:39 event 5384399 GET 404 bytes 7894

ann cred label cred

Request Auth endpoint request observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-10 01:14:18 event 4932451 GET 404 bytes 7895

ann base label observed

Request event observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-10 01:14:18 event 4932451 GET 404 bytes 7895

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-10 01:14:18 event 4932451 GET 404 bytes 7895

ann cred label cred

Request Auth endpoint request observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-08 06:20:03 event 4198669 GET 404 bytes 7897

ann base label observed

Request event observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-08 06:20:03 event 4198669 GET 404 bytes 7897

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-08 06:20:03 event 4198669 GET 404 bytes 7897

ann cred label cred

Request Auth endpoint request observed

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/logon.aspx

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-06 12:37:56 event 6901769 GET 404 bytes 7896

ann base label observed

Request event observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-06 12:37:56 event 6901769 GET 404 bytes 7896

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-04-06 12:37:56 event 6901769 GET 404 bytes 7896

ann cred label cred

Request Auth endpoint request observed

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

cred

rule

cred:auth_hit:auth_other

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/owa/auth/x.js

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-03-28 12:18:51 event 4281272 GET 404 bytes 7897

ann base label observed

Request event observed

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

# 2025-03-28 05:44:03 event 4237816 GET 404 bytes 7897

ann base label observed

Request event observed

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application

referer

-

UA

Mozilla/5.0 zgrab/0.x

summary

event observed

details

—

subnet

20.168.0.0/24

asn

8075 — Microsoft Corporation

geo

United States, Arizona, Phoenix

org

Microsoft Azure Cloud (westus3)

Page 1 of 1

← Prev Next →