&gt;Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub&#x2F;Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn&#x27;t cause as much collateral damage as blocking compromised-browser IPs.<p>But the &quot;great cannon attack&quot; was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: <a href="http:&#x2F;&#x2F;i.imgur.com&#x2F;0quYBdV.png" rel="nofollow">http:&#x2F;&#x2F;i.imgur.com&#x2F;0quYBdV.png</a> a graph of an attack on reddit, from 2013).<p>Today we&#x27;re talking about Mrps, not Krps.<p>&gt;If you did a watering hole attack, doing JS injection on a really popular &quot;show HN&quot; post on HN, against HN, you&#x27;d be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn&#x27;t really affect many regular HN readers.<p>That&#x27;d just be sloppy filtering, there&#x27;s no need to drop L7 attacks on IP basis.