The seemingly easy way to DoS it would be to hit pages with Bitcoin addresses.

You could even setup a hidden static page with hundreds or thousands of addresses and call it through that proxy. No load on the legit server but heavy load on the rogue proxy.

Welcome to the dark web. It's terrible here.

Note that since the phishing site proxies requests to the legit site, this also has a high risk of knocking the legit site offline.

Maybe with a layer 7 attack, but not with a layer 3 attack. The author also described the difference between the proxy request and a legit request, so he can just block the proxy requests. Try using slowhttptest. You don't even need a botnet.

I think the article described a different response, but not a different request? Anyway they mentioned that some requests were cached, so you could request a cached object to avoid hitting the original host, if you wanted a level-7 attack.