They are automated scripts. It is normal. On our mail servers there are maybe 5 attempts to breach password by dictionary attack every second. We use
fail2ban: Basically after X numbers of unsuccessful login attempts fail2ban block that IP in firewall for Y number of minutes.