The amount of brute forcing attempts on servers of all and any kinds I run is absolutely nuts. But yes they are often trying only a small number of common accounts/passwords.

I keep meaning to sit down and do a bit of analysis on the source of the connections.