Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub&#x2F;Great Cannon attack.  Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn&#x27;t cause as much collateral damage as blocking compromised-browser IPs.<p>If you did a watering hole attack, doing JS injection on a really popular &quot;show HN&quot; post on HN, against HN, you&#x27;d be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely.  Blocking 50k random botnet IPs wouldn&#x27;t really affect many regular HN readers.