> Every victim (such as readthedocs), or even people sharing blocklists

The report makes it pretty clear that the attack was distributed enough that profiling for blocklists was ineffective.