Only a single-digit percentage of bruteforcin and scanning attempts gets to our servers once we blocked China and Russia. Going by pure volume they're overwhelmingly overrepresented. I don't know about attack quality, I just assume sophisticated attacks could originate from anywhere, so I just pick the lowest hanging fruit