Ask HN: Why is this shady actor building a JavaScript botnet?

I run ChooseJarvis.com with my partner and our team. It's a social media automation tool. That's not relevant at all, it's just my job to tell you that. Our referrer logs show tons of hits from: http://cookie-law-enforcement-ii.xyz/ This is classic referrer spam. The above site links to http://cookie-consent.org/?lang=en Which is a mini marketing project of http://front.to/ Which according to ahrefs and google, nobody has ever heard of. Looks to me like they're building a massive Javascript botnet. Why? There's a lot of things you can do, right? Keylog all website visitors (?), replace all adsense units with your own ads, use all the clients/visitors as a DDOS botnet, click fraud (?), serve downloads, serve exploits, etc... The developers/websites have a sort of effortless polish that makes me more curious than I would otherwise be. If this is indeed shady, and it looks like it, this is scary. I imagine a LOT of webmasters might fall for this.