It’s just malicious actors scraping the Internet for vulnerabilities.

how to block them effectively? Just blocking .php and everything that contains in their path wp isn't very effective. After that you get many requests with .php7 and other paths...

Return 200 for /wp-admin

Just answering .php and everything that contains in their path wp with status 200 isn't very effective.

After that you get many requests with .php7 and other paths...

I haven't received more spam after returning 200 to /wp-admin. But you can just rate limit or filter using Cloudflare.

There isn't really much else you can do since requests will always hit your origin server.

hm ok. So every path, that includes /wp-admin will result in a 200 and that will work. Gonna try that