I generally do, yes. Working on the app I'm working on now, I can start the webserver and see hits to various exploitable assets on my server within about 10 s

I generally do, yes. Working on the app I'm working on now, I can start the webserver and see hits to various exploitable assets on my server within about 10 seconds. This is for a site that doesn't exist yet, on a subdomain that isn't easily guessable, on a domain that hasn't been registered for a solid month yet. I have little doubt these IP addresses are from China, as they always are, every time that I investigate, but yeah, generally these get blocked out before launch. If you're looking for it, there are country-specific blacklists all over the web, but the safer strategy (if you don't want to block out a bajillion potential users) is to look for suspicious activity and auto-blacklist. Hits to phpmyadmin, 1st.cgi, etc., automatically get blacklisted. A good sysadmin would do the same for portscans and intrusion attempts on non-web ports as well.