I do assume it is brute force/password spray.
More details in sibling reply: https://news.ycombinator.com/item?id=25739283