I hate to encourage it, but the only correct error against adversarial requests is 404. Anything else gives them information that they'll try to use against you.