• Eh, not that unlikely.
    The bots just scan everything they can.

    For example, I’ve seen a guy do some testing with SSH server on default port (22). On average, there was constant 10Mbps of traffic just from the login attempts.
    I can imagine it to be similar with websites.