What about tarpitting known spurious attacks? Possibly proxying/forwarding to a different host?