I look at my server log almost every day, and I keep seeing activity of someone/thing trying to find, for example, xmlrpc in all kinds of locations - the root, and in subdirectories that I don't have. It seems like the people trying to find this usually live in Amsterdam or an asian country.
Is there a legitimate cause for this, or am I right that if 'they' were to find it, they'd use it to cause trouble?

I also see people trying to get into phpMyAdmin, phpAuction, executing 'cmd' this or that, and other such suspicious activity.

I set up some criteria for deciding when to start turning them away and add the IP to my deny table. However, a friend commented that if they don't find what they're looking for they likely won't ever be back. Is that reasonable - am I just making my deny unnecessarily long?