I don’t think you understand what’s going on here. They misconfigured their CF and made it impossible for actual users to access their website. That boilerplate text means nothing. I submitted no words, no SQL, and no malformed data, merely a simple access request across multiple browsers.

If this amount of traffic across a small handful of users was enough to trigger a DoS, we should be getting proof-of-work captchas, not “you have been blocked” pages.

The site does work, including on Firefox for Android, for me in Denmark.

Perhaps there's an unreasonable geoblock configured.

Can confirm, I run my own stats on my own blog (no CF) and it's decidedly not easy to get dangerous amounts of traffic from HN.