Buried for being completely *****.A competently executed DDoS looks just like legit traffic. Effectively you can't distinguish between real and attack traffic. So you either apply your tricks to all traffic or none of it. And if you try to apply this "tarpit" technique to everything then your real traffic gets slowed down too & becomes unusable. Which means your back to fcking square one: Legit traffic can't use your site aka Denial of Service. No, you do what the big boys do: Take the server offline, Outgun the attacker on bandwidth or find a way to distinguish the attack traffic from real traffic.