There’s not really any benefit to the ISP to doing this. If there was, ISPs would already detect 3 quick requests from a client that fits this pattern and disa

There’s not really any benefit to the ISP to doing this. If there was, ISPs would already detect 3 quick requests from a client that fits this pattern and disable the domain hijacking for the second and third request (or even for all 3 if they’re confident enough that the first request is part of this pattern).