“They’d have to send it to us.” Not anymore. With HTTP2Shell, your own code can fetch the attack. Wait, what’s Brotli?

source