it works because the global ddos adversary doesn't run javascript