I have a lot of 404s in my logs for urls like /wp-login, /admin and similar. These are bot attempts to scan the site for vulnerabilities.
NOTE: My site is not WP nor has administration under /admin.
I have created nice reqex which ones meet, the bot is jailed over fail2ban. The question is, what status code show him. 404 - page not found - sound to basic to me. Isn't here something better, like 4xx, f* you!?
I think 404 does make sense in some ways. If an undesirable walks up to your house, sure you could shout at them to leave, but it might make more sense just to not answer the door. This has the added bonus of them not knowing whether you're actually not home or just not answering. A 404 is the equivalent of not answering the door.
Plus it's semantically correct, in the sense that those paths don't actually exist on your server anyways.
As a related thought, I would consider adding those paths to your robots.txt, so that you can be certain you're only banning bots that are hitting those URLs maliciously, and not for example because bingbot found a link to them on some dark corner of the internet.
403 implies that the resource exists but the request will not be fulfilled, and 410 implies that the resource used to exist but does no longer. Neither of those are really true, so I think 404 is the most correct anyways.
