It’s just trawlers, scripts that ping ip address ranges, and if they get a response, they try to login on port 22 with default passwords, and stuff like that, and run portscans to see what ports you have open, and they send standard requests to standard ports looking for access.

Essentially going around to everybody’s house and knocking on the door, and see if they can be easily let inside. they keep knocking until you stop answering the door. There’s stuff like fail2ban (I think) that blacklists any ip address that tries to login more than X amount of times

Unless somebody knows specifically what service you are running and what port is on, it is unlikely to be anything more sophisticated than that.