I professionally help sites deal with these kinds of attacks, and it is often the case that the source machines are all from a single provider, country, or othe

I professionally help sites deal with these kinds of attacks, and it is often the case that the source machines are all from a single provider, country, or other group. Typically we've found that this is due to some underlying app or service that they all use, an example would be a webhost that has all of their customers on an older vulnerable version of cPanel, or for something with more recency look at all the organizations that suffered a ransomware attack this week because they used the same vulnerable file transfer software.