The first attack based on the Javascript wasn't actually using Chinese IPs to do the attack. As otherwise it'd indeed be very easy to block by just blackholing Chinese traffic.

What it was actually doing was a massive MITM attack against non-SSLd HTTP connections from inbound connections to China, from Chinese users abroad visiting Chinese websites. It's an extremely clever trick that is only possible if you have the ability to mount mass MITM attacks on an entire country, but what it gives you is a massive ever shifting botnet.

The lesson I draw from this is that we need more SSL, we need it everywhere and we need it yesterday. I hope this stuff puts to rest the idea that some websites aren't worth being encrypted.