I also found that approach very interesting. It's the opposite of what you would intuitively do, ie let everyone in, vs. block everyone who's unknown.
As others have mentioned, the one concern I have is the load caused by playback of tt-monkeys (though I'm amused). Wouldn't it work equally well to simply do an Answer(), then Wait(100) without playback? And doesn't it also make sense to combine the above with a Fail2Ban keyed on the log of "BUFFOONS IP ADDRESS"? Regards, John
