GitHub seems to have done just this. Both attack URLs return >alert("WARNING: malicious javascript detected on this domain") They can probably serve that with

GitHub seems to have done just this. Both attack URLs return >alert("WARNING: malicious javascript detected on this domain") They can probably serve that without hitting their database servers.