Yeah, the UA is pretty consistent but very generic. It reads as a desktop browser.

We did not look up the AS number. Can you describe that we'd be looking for there? Based on how the address was changing, I assume they're using Tor or some kind of VPN that will obfuscate IP so I didn't spend much time looking at them.