How to "punish" unfortunate hackers trying to hack the site?

Question

Nginx

Good day
According to the Nginx logs, I see how all sorts of bad comrades are looking for holes on my sites. I want to "punish" them somehow.
It is clear that these are bots. To hammer on the IP of the request in response is stupid. The most interesting thing that I managed to come up with was to proxy such requests, for example, to the Kaspersky Lab website and add text like “this bad request was made to my site, you probably know better what to do with it” in the header.
Does anyone have any ideas on about this?

Answer 1

Just ban bots using fail2ban or CSF or whatever, even a self-written script + iptables.
In parallel, of course, not forgetting to maintain the state of security of their sites.
These imaginary "hackers" in most cases are just the background noise of the Internet, crowds of various bots scanning networks, guessing ssh passwords, looking for vulnerable services, default and dictionary passwords, etc. When a vulnerable victim is found, most often an auto-exploit is performed that connects the infected resource to the bot army.
As an experiment, as already suggested above, you can deploy a honeypot on a separate public ip (if available), for example, here is a ready-made distribution . Put his bare ass on the Internet and enjoy honeypot alerts.
And "punishing" this background noise is like carving the sea.

Answer 2

To understand and to forgive.
Think about IB.
Read manuals on secure Nginx configuration.
Conduct an assessment using Nessus (there is a full trial), Acunetix, Netsparker, Nikto (OpenSource).
Optional metasploit or armitage based on experience and knowledge.
Contact the "Department K" or specialized organizations.

Answer 3

Rejoice that your shoals are looking for you.

Answer 4

Set up fail2ban

Answer 5

If there is absolutely nothing to do, you can organize a honeypot.

Answer 6

IP2ASN
Find out who owns the subnet and write to the support.

Answer 7

Either write a statement to the police, or do not waste your time.

Answer 8

More control over the security of your sites.

Answer 9

play a joke
Pretend that they really broke in, and when they come in, play a joke