You're assuming the attacker has knowledge of both devices. The particular address you've listed is no stranger to random attacks. SANS Internet Storm Center lists it, it has appeared on other watch lists as well. One can conclude that this is either part of a botnet or some other automated scanning/hacker/badguy machine.
Botnets, compromised machines, etc., have a tendency to fire off massive amounts of recon scans against numerous amounts of machines. Think about it, if you were an attacker, why wouldn't you leverage one machine to scan many? What these machines do, is scour random, and or defined network blocks, enumerate what is visible, what is not, and pass this at times to other machines to perform the exploitation.
Consider the following:
Recon machine: 126.96.36.199
Exploit machine: 10.10.1.2
Recon machine goes out scours the net for potential victims. When/if it finds them, it usually passes it off to another machine to perform an exploit, or bruteforce attack. In the event you were vigilant and noticed a probe, you could block the Recon Machine, but the reality is, exploit machine will likely partake, or implement the attack.
While you perceive that the Recon Machine knows about your infrastructure, there is a high likelihood the initial probe was random. Then of course there is the alternative. Someone is targeting your network. In the event they were, it is not difficult to obtain information on companies, and the networks associated with them. Consider a random company: ACME, if I were targeting their network, I could use Arin and simply say: "Hey Arin, show me what networks might be associated with ACME" and with that information, I can target each network I find:
There are plenty of ways someone can target you, but my guess is, each network of yours that was found, was likely random.