Microsoft lists the IIS http status codes including the substatus codes here.
In the 404 section there are substatus codes between 0 and 20, but in my logs I get a 503 as sc-substatus
I can't find any information about it. Don't confuse this with the standard http 503 (Service unavailable) status.
A quick review of the site in question solved this question. It was setup with
IP Address Restrictions
, the 404.503 is logged for every request that is not from an allowed IP address.Normally a 403 (Forbidden) status is sent, but in IIS 7+ you can specify which status to return. In the 'Edit Feature Settings' for IP restrictions choose the 'Deny Action Type':