1. We are conducting an authorized Penetration test or Phishing engament that has been requested by your IT department.
2. We are using this host for a bug bounty project, from ex, H1 or Bugcrowd etc.
3. We accidentally stepped out of scope while doing 1) or 2)
4. Security research (Recently, Payloads were fired against a few thousand domains in order to see what comes back) In any case, there are no evil intentions behind these attacks.