This is what a DDoS attack against one of the sites I host looks like atm. The initial ramp up of nginx throttling kicking in (the graph is of the number of throttled requests) and finally source IPs are getting upgraded to /32 blocks in pfSense and when it detects that enough of them belong to the same subnet a /24 is applied instead. Silence until they rotate to new IPs.

Someone's paying money to keep this up. Not sure they're getting what they hope from it. Regular site users are noticing absolutely nothing at all ...