IP banning details?

I’m basically curious how WPBruiser handles IP banning (don’t know, maybe there’s even some kind of document you can point me to).

I turned on login form protection and automatic IP banning only a couple of days ago. WPBruiser seems to recognize the bad guys just fine – I can see their IPs under “blacklisted IPs” in the security tab. I’m surprised, however, to see that they still get a “200 found” response code as per my server logs. I understand this isn’t server level blocking, but shouldn’t they at least be getting “403 forbidden”?

Possibly related – if an IP hits my login form at 60 visits per minute, I would regard that as “brute force”, but according to WPBruiser, it’s just “failed login attempts”. WP Bruiser blocked the IP anyway, but I’d like to better understand the implications / differences.

Thank you.