The logs show a few odd spikes. Around 02:13 there was a burst of failed logins, then at 02:18 a successful one that came from an IP that usually stays in the dark zone. Nothing else stands out, but that timing matches the breach window. You might want to pull that IP’s history and see if it’s tied to any of the other incidents we’ve seen.

Sure thing. Pulling the logs for that IP now, and comparing them with the other incidents. If there’s a pattern, we’ll block it before it slips through again.