Small attacks are characterized by a small number of IP addresses and a large number of requests from each IP address. Thanks to this, attacks of this kind are completely blocked within minutes.
Attacks up to several thousand IP addresses. Already capable of "put" site on a dedicated server. With filtering, the attack rate is reduced by 90% for the first 5 minutes.
Distributed attacks from tens of thousands of IP addresses, often simultaneously on the web and mail server. With this type of attack, the number of requests from one IP is small, which makes it much more difficult to separate the natural traffic of the site from the malicious one.