Another version if this if the 301 is too much is to just close the connection then have a daemon or cron job shove their IP into a NFTables ipset or blackhole route them. Be sure to have exclusion elements so one can not block their own gateway or corporate SNAT groups.

    location ~* /(xmlrpc|wp-login\.php|wp-admin) { set $ban 1; return 444 ''; }

    # grep banip /etc/nginx.conf
    log_format banip '$remote_addr';

    # grep banip /etc/nginx/http.d/some-server.conf
    access_log /var/log/nginx/ban.log banip if=$ban;