[mr_toad]

Judging by the logs they’re mostly going after low-hanging fruit - Wordpress and similar software with default username and password . They probably get quite a few hits.