Saw this play out firsthand this week. Launched a small developer tool and within 48 hours had traffic from 38 countries — Netherlands and Singapore near the top, which matches the bot-heavy regions in this data.

The SSL cert observation in another comment here is accurate too. The second a domain goes live it gets discovered.