Automated token-refresh loop: single-IP, non-browser dominated sign-ins

Arnold Chan@slaz

•updated 4 days ago•0•0•1

Behavioral hunt for accounts whose non-interactive sign-ins over 30 days are dominated (>=95%) by a single IP using a scripted client (python/aiohttp/httpx/urllib) with no browser. Scripted now requires BOTH no browser AND a scripted user agent, and Microsoft ASN egress is excluded.