[quesera]

I always run a null default virtual host, which serves no content and logs no traffic (or maybe logs to a default-access.log).

It deflects a lot of blind security attacks..all of which would fail of course, but I don't need that noise in real log files.

This would solve your problem too. If you're feeling vindictive, redirect requests for the offending domain somewhere that will be bad for their SEO.

EDIT: I should add that a null default vhost will exclude HTTP/1.0 clients. But that's a non-issue unless you're serving to very old embedded systems.