A suspicious login attempt was detected from an external IP address. The attempt involved a targeted spear-phishing campaign aiming to harvest employee credentials. The attacker used a known malicious IP address to attempt access to an internal Twitter employee account.