If it's this easy to filter honeypots, then the real folks that know what they are doing will already be doing this, and these honeypots are just going to be picking up details about amateur script kiddies.
The real folks already know what they're doing, but the majority of "attacks" aren't real folks who are determined to hit specific targets; it's people who just throw everything at the wall to see what sticks, and this is what the honeypots catch.
The "real" folks aren't putting a lot of effort into spamming random Confluence installs. Being targeted individually is a separate class of problem.
There is actually a report on the frontpage today about Russian SVR attacking pretty random vulnerable installations of JetBrains TeamCity. Even very "real" folks do these kind of opportunistic attacks.