Bad guys use a botnet (compromised residential computers and routers) to defeat rate limiting and ip-based blocking.