A SOC analyst reviewing authentication logs for a public-facing web application notices the following pattern over a 15-minute window: successful and failed logins across 4,300 distinct usernames, each attempted exactly once, originating from a rotating pool of 87 residential IP addresses, with a consistent uncommon user-agent string. Overall failure rate is roughly 96%. Which type of malicious activity does this pattern MOST likely indicate?