Intrusion detection (Score 1)

someone might have suggested this already, but an automated script that does a whois on the ip from the appropriate internet number commitee (or whatever the hell you call them folks like arin, apnic, et al) and sends an email to the IP block's admin / abuse address would work. Mostly, these emails get ignored unless they start appearing in large volume (if someone is dumb enough to continue trying to intrude from the same ip block).