Two sites, same attack, different reaction from WF

Hi,

Two sites, same WF settings.

In the first site i see a firewall block:

blocked by firewall for WordPress New Install File Probing at https : // www. firstsite . com/oldsite/wp-admin/install.php

In the second site for the SAME attack (same IP of the attacker) i see:

404 not found – tried to access a non-existent page https: // www . secondsite . com/blog/wp-admin/install.php

Why is that? Shouldn’t the second also attack been blocked by firewall?

Thanks