Burst of SSPR failed attempts for 8 days around the clock

we saw a significant burst of SSPR failed attempts due to Password reset is not enabled for this user. the number of events was about 10x our baseline and run around the clock for 8 days which is not our usual pattern.

• 10,335 of the 13,468 failures sent one identical browser string, Chrome/151.0.0.0 on Windows 10, from 10,332 different IPs against 7,285 accounts.
• Every one of the 10,321 events from the two LogicWeb IPv6 blocks (2601:2008::/29, 2a01:e300::/29) used that string. Those blocks produced 92% of the Sep 7–14 burst.
• the spike was a continuous low-variance traffic across all 24 hours compare to our usual baseline where we have a spike at a certain time of the day and very little around that