WordFence posted a great article on “Why is an insignificant website like mine being attached?”, a very common question asked by owners of smallish sites.
Most of it comes down to money. Here’s a quick synopsis:
1) Using your host’s server to run their own programs (the latest craze is cryptocurrency mining)
2) Leveraging your reputation
a) hosting phishing pages
b) hosting spam pages and injecting spam links
c) sending spam email
d) attacking other sites
e) hosting malicious content
3) Leveraging your site contents
a) malicious redirects
b) defacements
c) distributing malware
4) Stealing data
5) Ransomware
Full article at: https://www.wordfence.com/blog/2018/03/ask-wordfence-why-is-an-insignificant-site-like-mine-being-attacked/