This question already has an answer here:
I just realised that I don't know how (denial) of service attacks are resolved especially in the long term.
The attacking machines don't get tired and there must be some cooperation involved in dealing with the attack.
How is an attack dealt with long term? Can a company under attack call some kind of special phone number? If an attack is from another country, how do people who deal with these attack cooperate?