I was just wondering if that meant we were more of an attraction than other sites.
probably not. if you put a machine on the net then it's going to get probed for all sorts of potential exploits, real or imaginary or obsolete or just hopeful - including ssh and mysql and ms sql and smb and telnet and rpc and hundreds/thousands of other ports, many of which haven't even had an exploitable version for over a decade.
since it's all done by bots, one IP address is as "attractive" as any other.
of course, if you've got some highly desirable or valuable data then your known IP address ranges may be specifically targeted, but mere presence or number of accessible machines doesn't make your site a more attractive target.
I've wondered about this. It really does seem that some IP addresses get hit much more often than others, for no otherwise obvious reason. There are various rbl lists around that provide free information about IP address blocks, and maybe this information could make some blocks more attractive than others? A home user would almost certainly be using a router of some sort which are almost always completely blocked off from outside access by default, while a server in a hosting center set up by a kid as a torrent drop point could likely be full of holes. An IP that is blacklisted as an open relay may also have all sorts of other security weaknesses (or not? That's just a guess). All this information about IP addresses, with a small degree of error, is easily obtainable by a bot. James