You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Ra

You misunderstand, these are not failed logins. These are web scanners trying to find common vulnerabilities in typical web software (phpMyAdmin, Wordpress, Rails, etc). But also potentially exploits in nginx or other parts of the stack for all I know. And they send requests by the hundreds, which pollutes my logs and my logwatch emails. I have automatic security updates turned on for my server, but it's not my full-time job to manage it, so I want to maximize the return on the time I do spend managing it. And since there is zero value/reason in allowing access to my server by anyone in those countries, why not just block it all and have one less thing to worry about, since 99% of that automated traffic comes from there?