This reminds me of the chat bot tool that was deployed to reply to scam emails and waste maximal time of the scammers by seeming like a vulnerable, gullible tar

This reminds me of the chat bot tool that was deployed to reply to scam emails and waste maximal time of the scammers by seeming like a vulnerable, gullible target. The chat bot would drag out the interaction slowly, wasting as much time as possible for the scammer, all the while posing as a real human. There are a lot of comments here decrying this as a method to defend your website, but in some senses it's a very smart tactical weapon, especially if deployed widely. There's an often quoted phrase in making secure password hashes that you're not making it impossible to crack, only prohibitively expensive to do so such that the benefits don't outweigh the costs. The same principle applies here -- if the good guys collectively make scanning a very expensive endeavor, the juice is no longer worth the squeeze for the bad guys. Just blocking an IP is cheap for them. Make them bleed a little.