That is essentially my thinking but I don't fully understand the profile of an attack. Small websites would go down, but something like google or twitter would certainly not simply cave. Twitter would serve cached content (as most sites) unless it was really nasty. I am not sure if I should manually set up logins and test for timeouts or potentially get away with testing status codes on example.com/login?

Do you know what signs or tests could be done on these robust services that would tip off an attack?