@AlecMuffett In practice, of course, it's no different to someone launching an attack via botnet - each attempt could easily come from a new subnet, again rendering the source IP irrelevant for future blocks - with a botnet it may also be a consumer range, so looks more legit than a tor exit