> I thought it was only people outside China who are being 
    > giving the poisoned javascript, and the requests are
    > being made on the client-side from them - which would
    > appear to be just random traffic

I would have thought you could usefully heuristically look at the referrer header.