Perhaps they&#x27;re saying: an attack on OSI Layer 7 (web apps themselves) that result in users receiving HTTP 400 status codes in response to their requests.<p>OSI Layer 7 would actually refer to all &quot;applications&quot;, but the mention of &quot;400 Bad Request&quot; implies specifically web applications were affected.