Hi Nils, I've been having some trouble blocking stuff with double forward slashes, so I'm sitting here testing this stuff using my VPN in case I block myself. Your solution works fine for me, in fact I'm going to leave your solution in my Wordfence Options in case I get the same kind of attack you did. So, thanks!
I tested with this URL https://www.****.com/another-page/?//mysite.com/?wordfence_logHuman=1&hid=274B1A86D9D9E151D52864CE0E3A9AB2
Without Wordfence set to block I got a 404 error.
With your solution */?wordfence_logHuman=1&hid=* placed in the Wordfence options, blocked URLs, I got blocked and was given the Wordfence blocked message.
Which reminds me, FEATURE REQUEST: Please please Wordfence I beg you to give us an easy option of using our own customized "blocked" announcement page. Your default one simply has too much information for my taste, and could also be cleaner in terms of server load if it's being fed to thousands of bots.
MTN