Sorry yes, in OSI it is, what I was referring to is the l7-filter/regex on RouterOS. I'm not seeing much resource usage on the address lists and mangle at all.
With all the recent DDOS stuff on various ISPs, perhaps you, like me, are failing over onto LTE like Rain or similar. I figured this may help someone as it took me a while to find everything out but seems to be a wonderfully elegant solution (I'm open to suggestions on doing this better too)...