Shared IP across multiple new-hire identities (laptop farm pattern)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•2•1•6

Detects anomalous authentication patterns where multiple distinct user identities authenticate from the same source IP (often a VPN or proxy) within a short timeframe, characteristic of North Korean IT worker laptop-farm or identity-mule operations where a single operator manages multiple contractor accounts.