"page not found" path ignored - is that correct?

Hi;

I'm facing waves of bogus requests on all my D7 sites, like these:
core/routes_policy.php
misc/routes_policy.php
core/ProviderData.php
misc/ProviderData.php
core/basefuncentry.php
misc/basefuncentry.php
core/DataFunctions.php
misc/DataFunctions.php
core/serve.php
misc/serve.php

After a while, I noticed that creating a rule for all of them is useless: the core/ rule (or in general, the one that's created first) would also catch the corresponding misc/ rule.

Is this how is it supposed to work? Path is not relevant in rules?

Thanks

Max