Malicious traffic is not limited to ssh and comes from the same usual suspects. Automated attacks against web applications is constant. I wouldn't say it's indiscriminate, it's practical.
The most general problem in Internet are not the malicious people - botnets can infect insecure devices ANYWHERE in the world. The main problem is that some (many) of the ISPs at the last mile allow outgoing IP packets with source IP address which is outside of the IP range(s) these ISPs operate/own. Larger ISPs on the upper layer can not prevent this because otherwise IP routing will break. So it all depends on the "last mile" ISPs. And it is quite possible for the "status quo" to live for many years ....
https://www.internetsociety.org/resources/2022/impact-of-ukr... https://labs.ripe.net/author/athina/how-sanctions-affect-the... https://labs.ripe.net/author/farzaneh-badiei/sanctions-and-t... https://www.sciencedirect.com/science/article/pii/S030859612... https://labs.ripe.net/author/moritz_muller/internet-sanction...