i used to work at a noc for a gaming company and i was the first and only responder – graveyard shift – when we suffered a ddos that employed user credentials that our postmortem found out were cheaply available – $5 – on the dark web. the list had hundreds of thousands of credentials w 80%+ of them being legitimate users and but only a few hundred or so had functioning passwords. i was able to prevent the service from being taken down w a simple bash while loop that collected the ip addresses from our logs and then add them to iptables for blocking on our gateway serviers and i’m thankful for the experience because the story it lets me tell during interviews enabled me to get multiple jobs since then.