A SOC analyst is reviewing web server logs during an incident. Every malicious request originates from a small set of source IP addresses that reverse-DNS resolves to a well-known anonymization network's exit nodes. Blocking these addresses has little effect, and new requests continue arriving from different addresses in the same category. Which evasion technique is the attacker most likely using to obscure their true origin?