But Of Course They Came Back

In the early hours CET, April 7th, 2009, the slow brutes showed up again.

Apr  7 05:02:07 rosalita sshd[4739]: error: PAM: authentication error for root from ruth.globalcon.net
Apr  7 05:02:15 rosalita sshd[4742]: error: PAM: authentication error for root from ip-206-83-192-201.sterlingnetwork.net
Apr  7 05:02:54 rosalita sshd[4746]: error: PAM: authentication error for root from cyscorpions.com
Apr  7 05:02:59 rosalita sshd[4745]: error: PAM: authentication error for root from smtp.bancomorada.com.br
Apr  7 05:03:10 rosalita sshd[4751]: error: PAM: authentication error for root from 82.192.86.217
Apr  7 05:03:25 rosalita sshd[4754]: error: PAM: authentication error for root from 66.135.60.203
Apr  7 05:03:52 rosalita sshd[4757]: error: PAM: authentication error for root from rainha.florianonet.com.br
Apr  7 05:04:00 rosalita sshd[4760]: error: PAM: authentication error for root from 72.11.144.34
Apr  7 05:04:34 rosalita sshd[4763]: error: PAM: authentication error for root from s1.serverhex.com
Apr  7 05:04:38 rosalita sshd[4765]: error: PAM: authentication error for root from mail.pitnet.com.br

Starting with 2318 attempts at root before moving on to admin and proceeding with the alphabetic sequence.

Data: Full log here, one line per attempt here, users by frequency here, hosts by frequency here.

And another slashdot storm The slow brute zombies are back (slashdotted).

And shortly afterwards, we learned something new -