I had to put this case here as Microsoft's answer won't make sense. What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 220.127.116.11, being flagged in Cloudflare firewall events due to its false user agents, IE6, used when trying to access our clients' sensitive data. I contacted Azure support and Microsoft Computer Emergency Response team relating to this IP and was told that the IP belongs to Azure infrastructure and it's a standard function of Windows Defender SmartScreen.
Found out this IP's in the blocked list in certain sites such as this one - https://www.abuseat.org/lookup.cgi
Although I blocked this IP address within the Cloudflare, an attempt to access our clients' data is still happening on a daily basis and I'm stuck on where to go from here to find out what's really going on. Some of the URL that this IP was trying to get to was restricted to our office network IP range adding more confusion.
Any help or point to a right direction would be very much appreciated.