One time, i would put a random stacktrace / error log containing fake server credentials/ card info etc on a page/ action letting those "hackers" waste their time digging into it.. only to found out that the server is just a repo of (i would like to say porn butthats still a win situation) useless things