Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of req

Never have been in a DDOS attack? Good luck doing anything without getting the IP. It's useful to know where the requests come from too. You get a bunch of request from IP that come from a specific peer and that peer is saturated? How could you verify that without a log? You want to add CDN to the right locations. Where should you? Really, I think it's just make more sense for any small company to block EU and when you have the means to do it correctly (with the help of a competent DPO), then yeah add that EU in your market.