[___timor___]

Redirect them to 169.254.169.254, where AWS serve some instance metadata. Maybe auth endpoint, which should result in throttling of their own instances and hopefully cause then troubles.

Gzip, deflate bomb could be another alternative.

Or maybe redirect them to a boat that can respond with TARP IT, filling their connections.