[geon]

> Great you “shadowbanned” an IP, but you also impacted many other people and devices behind that public IP

In this scenario it doesn't matter. Some user might be able to access the malware still, but that's better than not blocking it at all.