A SOC analyst is reviewing perimeter firewall logs and notices that a single external source IP generated hundreds of connection attempts to sequential destination ports (22, 23, 25, 80, 443, 3389, ...) on one internal host within a 15-second window. Nearly all attempts were denied by the firewall, and only a handful of ports returned SYN-ACK responses. Which activity does this pattern MOST likely indicate?