My site has recently been the target of some extremely aggressive "card testers" (criminals who have huge lists of stolen credit cards; they use bots to stuff small donations into donation forms to test which cards are still working). At first I just blocked the offending IPs, but they kept finding new IPs, creating a lot of annoying work for me. So I pivoted--instead of blocking their IPs, I started feeding them randomly generated false responses with a statistically accurate "success" rate. They are trying to build a list of working cards, and getting absolute garbage results.

It is still ongoing, but so far they have run ~50k card tests in over a week, and 99.9% of the data they have collected from us looks legit, but it is totally bogus. It pleases me to know that I am polluting their data, and ultimately wasting a lot of their time and effort. Consume excrement, evil-doers!