This is an SEO thing, they hijack your domain to get their rank up a bit then ditch you for their commercial website. Had that once working for a client, just added a rule about if requests came from the fake URL I redirect them to a porn website. Worked like a charm and they stopped their scam by the end of the day.

Can't you turn the tables by sending a permanent redirect to your own domain, thereby stealing whatever SEO ranking they built up?

I'm not an SEO expert just asked around around the office, Googled it, and then acted. I was just a backend dev and this (a part from a couple of vague forum questions) is not that well documented, so I don't know how this works exactly.

You can setup a virtualhost for that URL and have some fun with the domain. (Think; porn, disgusting stuff, extremist stuff)

No need to be malicious unless you're sure. A common mistake not to keep A records updated for domains sitting disused.

Perhaps, just redirect to a non locally hosted neutral page saying something like "The domain you requested was redirected to an invalid server. The reason for this is not clear."

I'd not like a redirect on my server sending people to something deliberately offensive; that reflects on me.