i used to work at a noc for a gaming company in the early 2010's and i was the first and only responder -- graveyard shift -- when we suffered a ddos that employed user credentials that our postmortem found out were cheaply available -- $5 -- on the dark web.

the list had hundreds of thousands of credentials w 80%+ of them being legitimate users and but only a few hundred or so had functioning passwords.

i was able to prevent the service from going offline w a simple bash while loop that collected the ip addresses from our logs and then add them to iptables for blocking on our gateway servers dynamically and i'm thankful for the experience because the story it lets me tell during interviews enabled me to get multiple jobs since then.