I'm almost certain its most likely a credential farming operation at this point