UNC6671 Residential Proxy Sign-ins: Rarity + Sensitive-Action Correlation

Duo Tech@duotech

•updated Aug 9, 2026•12•1•19

Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).