@realcaseyrollins pretty sure it's some random scanning botnet, around 3800 (some tried empty account so my awk printed the wrong column, but not too many) different IP addresses.
maybe they're betting that root login is disabled on most boxes