Triton is incorrectly reporting the source IP for some users in Investigative Reports. In one case it attributed multiple users as having a source IP of 58.245.96.222, which is a Chinese IP. Triton continued to show that as a source IP for users even after we blocked it at the Firewall and they are on our LAN.
Anybody ever seen this happen?