This graph shows the failed logins into one of our servers for the past month. As you can see they get hammered - just like most servers on the Internet.
As you can see 122.3.9.40 is a busy little server, whois reveals the system is based in the Philippines. A google of the IP shows it be on a number of lists of attacking systems, including one called botnet.txt. So as is likely for most the high scores in this list, they will no doubt be compromised machines used to launch attacks scanning whole ranges of IP's for open or poorly passworded ssh servers.
So now might be a good time to reset all your accounts and make sure you have strong passwords. These ssh brute force attacks are not going away any time soon.
An excellent method of avoiding these attacks is to change your ssh listen port. Simple to do - just change the "Listen" directive in /etc/sshd/sshd_config.