Ask HN: Fun or clever ways to teach bots a lesson?

One of our clients has stopped using WordPress but is still seeing a lot of traffic to the usual core php files (ex: wp-admin.php / wp-login.php / xmlrpc.php). Instead of blocking these and returning a 403, what do you guys suggest would be a fun or clever way to handle these? Make these bots download a gigantic blob file? Make a fake login page that submits their info to the abuse address of their own host? Something else?