During an investigation, a SOC analyst notices that all of the malicious HTTP requests targeting the company web application appear to originate from a small set of well-known anonymizing service IP addresses rather than from a single consistent host. The attacker's true origin cannot be determined from the web server logs. Which evasion technique is the attacker most likely using?