At my last job, we would get casually DDoSeD from time to time. One of the ones I remember was a wordpress pingback reflection to a large file. Not too hard to handle (pingback is dumb and needs to die in a fire, but at least wordpress sets user-agent), but used a ton of bandwidth until sorted it out.