On my server I still see lots of attempts coming from the same IP-address. I presume the individual drones of a botnet don't coordinate their attacks, so they wouldn't be able to achive a sufficient attack rate per minute to brute-force the passwords.