I don't think it's totally random, when my server got taken over I found a list of ip addresses that the script was in turn trying to bruteforce. Someone made that list on purpose, though I don't know why or where the ip's came from.