Yep, and the Wordpress /wp-admin login attempts, even if you don't even run Wordpress. You'll see these attempts in less than an hour when launching a new web server so definitely is automated.

You're of course right about bad actors not representing "the world", but when 99% of interactions is hostile, one's perception of reality changes.