> You've just redirected one of your legitimate users to the attacker.

I interpreterd it as being redirect back to your own address. E.g if I'm an attacker and my IP is [FE80::2], then I'd be redirected to [FE80::2]. Same for an user. And if you've got attackers from 10k IPs, then I'd think it'd be unlikely that you'd single out a single attacker IP.