I would imagine they see the same blocked message everyone gets, from the site they try to access. Since the ip's are sent to Wordfence scanning servers (watch the live scan sometime) I'm guessing that's where they reside. Does that answer your question?
tim